ISO 42001 certification works by having an independent certification body audit your organisation’s AI Management System (AIMS) against the requirements of the ISO 42001 standard and then issuing a certificate if your system meets those requirements. The process covers how you govern artificial intelligence responsibly, from risk assessment to transparency and accountability. Below, we answer the most common questions about how the certification actually works in practice.
What requirements must an organisation meet for ISO 42001?
To achieve ISO 42001 certification, an organisation must establish, implement, and maintain a documented AI Management System. This means having clear policies for how AI is developed or used, a process for identifying and managing AI-related risks, defined roles and responsibilities, and a commitment to continuous improvement. The standard applies regardless of whether you build AI yourself or use third-party AI tools.
In practical terms, the core requirements include:
- Context and scope: Define which AI systems and processes fall under your AIMS and understand how internal and external factors affect your AI activities.
- Leadership commitment: Senior management must actively support the AIMS and assign clear ownership for AI governance.
- Risk and impact assessment: Identify potential harms your AI systems could cause to individuals, groups, or society, and document how you address them.
- Operational controls: Put concrete measures in place to manage AI development, deployment, and monitoring responsibly.
- Performance evaluation: Regularly review how well your AIMS is working through internal audits and management reviews.
Importantly, ISO 42001 is designed to be proportionate. A small digital agency using AI tools does not need the same level of documentation as a company building autonomous systems. The standard scales to the size and complexity of your AI activities.
How does an ISO 42001 audit actually work?
An ISO 42001 audit is a structured review conducted by an accredited or recognised certification body to verify that your AI Management System meets the standard’s requirements. It typically takes place in two stages: a document review followed by an on-site or remote assessment of how your AIMS operates in practice.
Stage 1: Document review
In the first stage, the auditor reviews your written policies, risk assessments, and AIMS documentation. This is essentially a readiness check. The auditor confirms that your system is properly designed on paper before moving to the operational assessment. For digital companies, this stage is usually conducted fully online.
Stage 2: Operational audit
In the second stage, the auditor examines how your AIMS actually functions day to day. They will interview relevant staff, review evidence of your processes in action, and check that controls are genuinely being applied, not just documented. For digital organisations, this audit can be carried out entirely via video call and shared digital documentation, which makes the process faster and more accessible than traditional on-site audits.
If the auditor finds gaps, these are documented as nonconformities. Minor issues can often be resolved quickly; major nonconformities need to be addressed before certification is granted. Once everything checks out, the certificate is issued.
How long does ISO 42001 certification take?
For most small and medium-sized organisations, ISO 42001 certification takes anywhere from a few weeks to a few months, depending on how mature your existing processes are and how quickly you can build out your AI Management System. If you are starting from scratch with no governance documentation in place, allow more time for preparation than for the audit itself.
Organisations that already hold certifications like ISO 27001 have a meaningful head start. Many of the structural elements, risk management processes, internal audits, management reviews, and documented controls, carry over directly into an AIMS. For those organisations, the additional preparation for ISO 42001 can be significantly shorter.
With modern digital platforms that support AI-assisted documentation, the preparation phase that once took months can now be compressed into days. The audit itself typically spans one to two days for a small organisation.
What’s the difference between ISO 42001 and ISO 27001?
ISO 42001 focuses on the responsible governance of artificial intelligence, while ISO 27001 focuses on protecting information security. The two standards address different risks and are built around different concerns, though they complement each other well for any organisation that uses AI to handle sensitive data.
Here is how they compare on the key dimensions:
- Subject matter: ISO 27001 protects data confidentiality, integrity, and availability. ISO 42001 governs how AI systems are designed, deployed, and monitored to avoid harm and ensure accountability.
- Risk focus: ISO 27001 is primarily concerned with cyber threats and data breaches. ISO 42001 addresses AI-specific risks such as bias, lack of transparency, unintended consequences, and misuse.
- Audience: ISO 27001 is relevant to any organisation handling data. ISO 42001 is specifically relevant to organisations that develop, deploy, or rely on AI systems in their operations.
- Structure: Both follow the same ISO high-level structure (Annex SL), which means organisations already certified to ISO 27001 can integrate ISO 42001 into their existing management system without starting from scratch.
For digital companies using AI tools to process customer data, holding both certifications sends a strong signal to clients and partners about responsible, secure operations.
Who should get ISO 42001 certified?
ISO 42001 certification is relevant for any organisation that develops, deploys, or meaningfully relies on AI systems as part of its services or operations. This includes software companies building AI-powered products, digital agencies using AI tools in client work, SaaS providers incorporating machine learning features, and professional services firms using AI for analysis or automation.
You do not need to be an AI company in the traditional sense to benefit from certification. If AI plays a meaningful role in how you deliver value to clients, whether through automated recommendations, natural language processing, predictive analytics, or similar capabilities, ISO 42001 gives you a framework to govern that responsibly and demonstrate it externally.
Certification is particularly useful for organisations that:
- Sell services to enterprise clients or public sector organisations that require documented AI governance
- Operate in regulated industries where AI accountability is increasingly expected
- Want to get ahead of emerging AI regulation, such as the EU AI Act
- Need a credible way to differentiate themselves on trust and transparency
How much does ISO 42001 certification cost?
The cost of ISO 42001 certification depends on the size of your organisation, the complexity of your AI activities, and the certification body you choose. For small organisations with straightforward AI use cases, total costs, including preparation and the audit itself, typically range from a few thousand to around ten thousand euros or pounds. Larger organisations or those with complex AI systems will pay more.
The main cost components to plan for are:
- Preparation: Building your AI Management System, including documentation, risk assessments, and internal audits. Using digital tools or AI-assisted platforms can reduce this cost substantially compared to hiring external consultants.
- Certification audit: The fee charged by the certification body for the Stage 1 and Stage 2 audit. This varies by provider and audit duration.
- Surveillance audits: ISO certificates are typically valid for three years, with annual surveillance audits to confirm ongoing compliance. These are usually shorter and less expensive than the initial certification audit.
For organisations already certified to ISO 9001 or ISO 27001, integrated audits covering multiple standards at once can reduce the overall cost per certification.
How DICIS AG helps you get ISO 42001 certified
We built our platform specifically to make ISO certifications accessible for small and digital organisations, and ISO 42001 is no exception. With us, you get a fully online certification process that removes the complexity and cost that typically make AI governance certification feel out of reach.
Here is what working with us looks like in practice:
- AI-assisted documentation: Our platform guides you through building your AI Management System with intelligent templates and prompts, cutting preparation time from months to days.
- Fully remote audits: Audits are conducted entirely online via video call and digital documentation, no travel, no disruption to your operations.
- Transparent pricing: No hidden fees. You know exactly what you are paying before you start.
- Expert support: Our team is available to answer questions throughout the process so you are never left guessing about what you need to do next.
If you are ready to get your organisation ISO 42001 certified, reach out to us today and we will walk you through the next steps.
