What Is ISO 42001 Certification?
- Certification is issued by an accredited certification body after a two-stage audit, and lasts three years with annual surveillance.
- Only a certification body can issue it. A consultancy that helps you build the system is barred from certifying it.
- Check that the body holds accreditation for ISO/IEC 42001 specifically. UKAS issued its first such accreditations in January 2026.
- Certification body fees commonly run £4,000 to £20,000 for a small to mid-sized organisation, separate from implementation cost.
- The internal audit required by Clause 9.2 must happen before certification and every year after, and your certification body cannot do it.
What certification is
ISO 42001 certification is a formal statement by an accredited third party that your AI management system meets the requirements of ISO/IEC 42001. You receive a certificate, valid for three years, which you can publish and send to buyers.
It differs from SOC 2 in an important way. SOC 2 produces a private report describing what an accounting firm found. ISO 42001 produces a public certificate confirming conformance. That makes it more useful in procurement, because a buyer can verify it without a confidentiality agreement.
Who can issue it
Accredited certification bodies, which are themselves accredited by a national accreditation body: UKAS in the United Kingdom, ANAB in the United States, DAkkS in Germany, and equivalents elsewhere, all operating under ISO/IEC 17021.
Two consequences follow, and both are structural rather than a matter of preference.
A certification body cannot consult on the management system it will certify. If a firm offers to build your system and certify it, one of those two is being done by a different legal entity, and you should know which.
A certification body cannot perform your internal audit. Clause 9.2 requires one before certification and annually thereafter, and independence rules put it outside the certifier's scope. This is covered in ISO 42001 - Internal Audit Consultants.
Accreditation, and why it matters now
The market is young. UKAS granted its first ISO 42001 accreditations in January 2026, and other national bodies have been building their schemes over a similar period. Before that, certificates were issued by bodies without accreditation for this specific standard.
Those certificates are not fraudulent, and many were issued after genuine audits. They simply carry less weight, and buyers with mature vendor review processes now check.
Ask any certification body one question: do you hold accreditation for ISO/IEC 42001 specifically, from which national accreditation body, and can you show the scope entry. General management system accreditation is not the same thing.
The two-stage audit
Stage 1 is a documentation and readiness review. The auditor examines your AI policy, scope, risk assessment, impact assessments, Statement of Applicability, internal audit results and management review. The output is a report identifying anything that would prevent a successful Stage 2, which gives you time to fix it.
Stage 2 tests whether the system operates. The auditor interviews people, samples records, and checks that the controls in your Statement of Applicability are running as described. Findings are recorded as major or minor nonconformities, and major ones must be closed before a certificate is issued.
Audit duration is set under ISO/IEC 42006, which governs how certification bodies calculate effort for this standard. Well-prepared organisations with strong documentation can sometimes justify shorter durations, which is one of the ways preparation reduces cost.
What it costs
| Component | Typical range |
|---|---|
| Certification body fees, small to mid-sized organisation | £4,000 to £20,000 for the initial cycle |
| Certification body fees, large or multi-site enterprise | £20,000 to £80,000 and above |
| Annual surveillance audit | Roughly 20% to 40% of the initial audit fee |
| Recertification at year three | Typically 70% to 90% of the original Stage 2 fee |
| Implementation, separate supplier | £15,000 to £50,000 |
The audit fee and the preparation fee are two different line items paid to two different organisations, and they should never appear as a single number in a proposal.
Fees run higher than the ISO 27001 equivalent for a simple reason: fewer bodies are accredited, so demand outstrips supply. That should ease as more bodies gain accreditation.
How long it takes
Three to six months end to end is the realistic range for an organisation starting with some governance already in place. Longer if you are starting from nothing, shorter if you already hold ISO 27001, because the management system framework, the documentation habits and the audit familiarity all transfer.
The sequence that sets the timeline is fixed: build the system, run it long enough to generate records, complete the internal audit and management review, then Stage 1, then Stage 2. You cannot compress the part where the system has to have actually operated.
What certification proves, and what it does not
It proves that an accredited third party examined your AI management system and found it conformant on the audit date, and that surveillance continues.
It does not prove any particular model is accurate or fair. It does not make you compliant with the EU AI Act, although it builds most of the substance the Act's high-risk duties assume. And it does not survive neglect: surveillance audits find systems that stopped operating after the certificate arrived.
What to do next
Get quotes from at least three accredited certification bodies, and confirm each holds accreditation for this standard. Do that early, because availability affects your timeline more than price does.
Our free readiness diagnostic gives a first view of where you stand, and our certification readiness and audit support service covers preparation through both stages.
References
FAQ
Who issues ISO 42001 certification?
An accredited certification body. Your consultancy cannot, and neither can your certification body consult on the system it certifies.
How long does ISO 42001 certification last?
Three years, with surveillance audits in years two and three and recertification at the end.
What does ISO 42001 certification cost?
Certification body fees commonly £4,000 to £20,000 for a small to mid-sized organisation, separate from implementation at £15,000 to £50,000.
Does accreditation matter?
Yes. UKAS issued its first ISO 42001 accreditations in January 2026. Confirm any body holds accreditation for this standard specifically, not management system certification generally.
How quickly can we get certified?
Three to six months is realistic. The limiting factor is that the management system has to operate long enough to produce records for the auditor to sample.
About Hael
Hael is an advisory firm specialising in AI governance and security compliance. We take companies through ISO/IEC 42001 from gap analysis to certificate and maintain the position afterwards. We are not a certification body, we do not issue certificates, and we take no commission from certification bodies. On engagements involving regulated financial services firms we work alongside Buckingham Capital Consulting, the partner firm that has advised payment and e-money firms on FCA authorisation and compliance since 2013.
This guide is general information and is not professional advice on your particular circumstances.