ISO 42001 consultancy services
- Six workstreams: gap analysis, implementation, internal audit, certification support, buyer security reviews, and continuous assurance.
- Your consultancy cannot certify you, and your certification body cannot consult on the system it will certify. That separation is structural.
- Internal audit is the workstream that recurs annually, which makes it the most valuable long-term relationship.
- Fees commonly run £15,000 to £50,000 for a full implementation, with certification body fees always separate.
- Ask whether the engagement covers the operating period between build and audit. That is where systems stop running.
What consultancy services cover
ISO 42001 consultancy services cover the work of building an AI management system that will pass audit and keep working. That work divides into six workstreams, and knowing which of them a proposal includes is the practical way to compare firms.
One rule shapes the whole market. Under ISO/IEC 17021, a certification body cannot consult on a system it will certify, and it cannot perform your internal audit. So implementation and certification always come from different suppliers, and that is a protection rather than an inconvenience.
The six workstreams
Gap analysis. A requirement-by-requirement comparison against Clauses 4 to 10 and the Annex A controls, stating what is met, what is not, and what closes each gap. This is our readiness and gap assessment, delivered as a fixed fee with a delivery call.
Implementation. The AI policy, roles and responsibilities, the risk assessment and treatment process, AI system impact assessments, data governance for AI, lifecycle controls, third-party oversight, the Statement of Applicability and the documentation set. The bulk of the effort sits here. Covered by our implementation service.
Internal audit. Required by Clause 9.2 before certification and every year afterwards, and it cannot be done by your certification body. Most organisations have nobody in house with the independence and competence to do it. Covered by our internal audit service.
Certification support. Selecting an accredited certification body, preparing for Stage 1 and Stage 2, briefing the people who will be interviewed, coordinating evidence, and handling findings. Covered by our certification readiness and audit support service.
Buyer security reviews. Answering the AI sections of customer questionnaires from the same evidence base, which for many organisations is the reason the certificate was needed at all. Covered by our buyer assurance and security reviews service.
Continuous assurance. Keeping the system operating between audits, running the annual cycle, and updating impact assessments when systems change. Covered by our continuous governance and assurance service.
What a consultancy cannot do
Certify you. Only an accredited certification body can, and it must be a different organisation from the one that built your system.
Perform both your implementation and your certification body's audit. That is the same rule stated the other way around.
Operate the management system for you. Impact assessments require people who understand the systems. Risk decisions require people with authority. A consultancy designs, documents, trains and chases, but the system runs inside your organisation.
Typical fees
| Service | Typical fee |
|---|---|
| Gap analysis | £5,000 to £15,000 |
| Full implementation, small to mid-sized organisation | £15,000 to £50,000 |
| Internal audit, per annual cycle | £4,000 to £12,000 |
| Certification support | Often within the implementation fee, otherwise £4,000 to £10,000 |
| Continuous assurance | Retainer, scope dependent |
| Certification body fees, always separate | £4,000 to £20,000 initial cycle |
| Independent practitioner day rate | £700 to £1,600 |
Confirm in writing that the certification body's fee sits outside the consultancy fee. It always does, and it should appear as a separate line in any honest proposal.
The workstream that recurs
Internal audit is the one that comes back every year for as long as you hold the certificate. It cannot be done by your certifier, and in most small and mid-sized organisations there is nobody internal with both the competence and the independence to do it.
That makes it the most durable part of the relationship and, for you, the part worth getting right. An internal audit that finds nothing is usually an internal audit that was not independent, and the surveillance audit finds what it missed.
The subject is covered in full in ISO 42001 - Internal Audit Consultants.
Advisory or delivery?
An advisory engagement gives you guidance while your team writes the management system. This works when you have people who have implemented a management system before.
A delivery engagement means the firm writes the policy, builds the risk process, produces the impact assessment method and the Statement of Applicability, and runs the project. This costs more and suits organisations with no management system experience in house.
The question that separates them in a proposal is who writes the Statement of Applicability and the impact assessment method. Ask it directly.
How it interacts with a compliance platform
Platforms increasingly carry ISO 42001 content: control mappings, policy templates, evidence tracking. They reduce administration genuinely.
What they do not do is decide your scope, write an impact assessment that reflects your actual systems, or make the judgement calls a Statement of Applicability records. We work inside whichever platform you already own and configure it properly, and where there is none the engagement runs on the Hael platform, which is included and stays available to you afterwards.
What to do next
Establish your scope and your target certification date, then get proposals against both. Two proposals cannot be compared until they cover the same scope.
Our free readiness diagnostic gives a first view, and the ISO/IEC 42001 service page sets out how we deliver each workstream.
References
FAQ
What do ISO 42001 consultancy services include?
Gap analysis, implementation, internal audit, certification support, buyer security reviews and continuous assurance.
Can our consultant also certify us?
No. ISO/IEC 17021 prevents a certification body from consulting on a system it certifies, so the two are always different suppliers.
How much does ISO 42001 consultancy cost?
Commonly £15,000 to £50,000 for a full implementation, with certification body fees of £4,000 to £20,000 separate.
Do we need help with internal audit?
Usually yes. It is required annually, it cannot be done by your certifier, and most organisations have nobody with both the competence and the independence in house.
Will a compliance platform replace a consultancy?
It will reduce administration. It will not set scope, write your impact assessments or make the judgement calls a Statement of Applicability records.
About Hael
Hael is an advisory firm specialising in AI governance and security compliance. We do the work, hold the deadline and stand behind the evidence, across ISO/IEC 42001, the EU AI Act, SOC 2 and ISO 27001. We are not a certification body, we do not issue certificates, and we take no commission from certification bodies or platform vendors. On engagements involving regulated financial services firms we work alongside Buckingham Capital Consulting, the partner firm that has advised payment and e-money firms on authorisation and compliance since 2013.
This guide is general information and is not professional advice on your particular circumstances.