ISO 42001: What Certification Buys, and What It Costs

A buyer has asked whether your AI is governed. You can answer with a policy document, or you can answer with a certificate somebody else issued, and ISO/IEC 42001:2023 is the second option.

It is a management system standard, which is a specific and often misunderstood thing. It does not certify that your model is accurate, fair or safe. It certifies that you have a system for managing AI risk, that the system is documented, that you follow it, and that an accredited auditor checked. The distinction matters because buyers frequently believe they are getting the first and are getting the second.

The published shape is consistent across sources. ISO's own catalogue entry for ISO/IEC 42001:2023 says the standard is for organisations of any size that develop, provide or use AI-based products or services, across all industries, with public sector agencies and non-profits included. Certification comes from an independent body using accredited auditors, in a two-stage audit, and the stages are rarely back to back. BSI, a certification body, publishes the same shape for every management system it certifies: a Stage 1 audit, then a Stage 2 audit, then surveillance audits once or twice a year across the three years a certificate is valid, then recertification.

Timelines cluster between four and nine months, with one source giving four to six for an SME and six to twelve for an enterprise, and another three to nine. An existing ISO 27001 programme shortens it materially, because most of the management-system scaffolding is the same.

Costs are quoted inconsistently and the honest summary is that your own staff time dominates, which is the one point every source agrees on. Published figures range from tens of thousands for a small AI SaaS company to six figures and beyond for a large enterprise, and the certification body's fee is the smaller part.

Three questions decide whether to do this. Is a specific deal blocked on it? Do you already hold ISO 27001? And can you name the person who will own the management system after the certificate arrives?

What the standard actually asks for

ISO 42001 certifies a management system, not a model. It asks you to inventory the AI you run, assess each system's risk by a documented repeatable method, choose controls and justify the ones you rejected, operate them with evidence the process was followed, review on a cycle, and be transparent with those affected.

Stripped of the clause numbering, the obligations are recognisable to anyone who has been through a management system before.

Know what AI you have. An inventory of systems, what they do, what data they use, and who is responsible. Most organisations discover during this step that they have more AI in production than anyone had listed, usually inside purchased software.

Assess the risk of each one, in a documented, repeatable way. Not a one-off workshop but a method anybody can apply to the next system, producing comparable results.

Decide what to do about the risks, with controls that are chosen deliberately and justified, including the ones you decided not to apply.

Operate the controls and prove it. This is where most of the ongoing effort sits and where audits find problems. Evidence that the process was followed, not merely that it exists.

Review and improve on a cycle, with management involvement that is documented rather than assumed.

Be transparent with the people affected. Where an AI system touches individuals, the standard expects them to know and expects a route for them to contest or escalate. For consumer products this is a product change rather than a document, and it is the clause most likely to generate real work.

None of this is exotic, and that is the point. The work is in doing it consistently across every AI system you run, including the ones embedded in tools you bought.

Does ISO 27001 help with ISO 42001?

The economics change completely depending on your starting position, and this is the first thing to establish.

If you hold ISO 27001, much of the structure transfers. Scope definition, management review, internal audit, corrective action, document control and risk methodology are substantially shared, and sources consistently note that an existing programme shortens the timeline.

What does not transfer is the AI-specific content. Impact on individuals, data and model lifecycle management, transparency to affected people, human oversight, and the decision about which uses are acceptable at all. These are new, and they need people who understand the systems rather than only the paperwork.

SOC 2 overlaps less than people assume. It is a different framework with a different audit model, and holding one does not shorten the other much beyond general evidence-collection discipline.

Regulatory alignment is a genuine secondary benefit. The work of inventorying systems, classifying risk and documenting oversight is the same work several AI regulations require, so a management system built for certification answers a good proportion of a regulatory questionnaire too. It is not a substitute for compliance with any specific law, and anyone telling you it is should be corrected.

Expect the inventory step to be the surprising one. Teams discover AI inside purchased software, inside a feature somebody shipped quietly, and inside a workflow automation nobody classified as AI. Each of those is in scope, and finding them is useful regardless of whether you proceed to audit.

Start by mapping what you already have against the clauses. For organisations with a mature security programme the gap is often smaller than the proposals suggest.

How much does ISO 42001 certification cost?

Published figures vary enough to be unhelpful without context, so here is how to read them.

The certification body's fee is the quotable part and the smaller one. Sources advise budgeting Stage 1 and Stage 2 separately and getting several quotes, because they vary widely between bodies.

Implementation is the larger line. One source cites framework implementation at $50,000 to $150,000 for enterprises; another gives a total first certification of roughly AUD $30,000 to $80,000 for an AI SaaS company; a third says costs can run from hundreds of thousands to millions depending on size and complexity. These are not contradictory so much as describing different organisations.

Internal staff time is repeatedly named as the biggest hidden cost, and it does not appear on any invoice. Someone has to write the policies, run the risk assessments, collect the evidence and manage the auditors, and that person has another job.

Consultancy is optional and commonly bought. A consultant shortens the calendar and does not remove the internal effort, because the evidence has to come from your actual operations.

The sales benefit arrives before the certificate does. Buyers asking the question are usually satisfied by evidence that the programme is underway with a target date, which means the commercial return starts at the point you commit rather than at the point you pass.

Budget the second year before you commit to the first. Certification is an ongoing commitment with surveillance audits reviewing scope changes, risk management and incident handling. A programme that cannot be sustained produces a lapsed certificate, which is worse than never having had one.

Scope is the lever that controls everything

The single biggest determinant of cost and timeline is how much of your organisation you put inside the boundary, and scope is yours to define.

Narrow is legitimate and sensible. One product, one team, the AI systems that product uses. That is a defensible scope and it is dramatically cheaper than certifying everything.

The certificate states the scope, and buyers read it. A narrow scope that excludes the product your customer is buying is a certificate that does not answer their question, so the boundary has to contain what matters commercially rather than what is convenient internally.

Third-party AI inside your product is in scope whether you built it or not. If your application calls a model provider or embeds a vendor's AI feature, governing that is part of your system, which means supplier assessment and contractual terms are part of the work.

Internal AI use is a scope decision too. Staff using assistants on company data is AI your organisation uses, and whether that sits inside the boundary changes both the work and what the certificate means. Excluding it is defensible; doing so silently is not.

Expanding scope later is a change the auditor reviews, not a quiet update, so a deliberate first scope with a planned expansion is better than an over-ambitious one that stalls.

Write the scope statement early and test it against your buyers' questions. If it does not answer them, it is the wrong scope regardless of how clean it is to implement.

When is ISO 42001 not worth doing?

Certification is a commercial instrument. The question is not whether governance is good but whether the certificate pays.

Do it when a deal is blocked on it. Enterprise and public-sector procurement increasingly asks, and a certificate converts a long questionnaire into a document. If you can name the deal, the business case writes itself.

Do it when your market is moving. If competitors are certifying and your buyers are comparing, absence becomes a question you answer in every sales conversation.

Do not do it to feel organised. The management system delivers most of the internal benefit; the certificate is the external proof. If no one outside is asking, build the system and skip the audit until they do.

Do not do it instead of regulatory compliance. They overlap and they are not the same, and a certificate will not satisfy an obligation imposed by law.

Do not do it without an owner. The commonest bad outcome is a certificate achieved by a consultant and a push, followed by a surveillance audit nobody prepared for.

Ask the buyer what they actually need. A surprising proportion want answers to specific questions rather than a certificate, and finding that out is a conversation rather than a programme.

The middle path is underused: build the management system, document it honestly, and answer buyer questionnaires from it. Many buyers accept that, and you can certify later with most of the work already done.

Who has to be involved, and why it is not a compliance project

Management system work fails when it is handed to one function, and this standard reaches further into engineering than security certifications usually do.

Engineering owns the evidence. Human oversight documented in a policy has to exist in the product as an actual step somebody takes. Model versioning, data lineage, the ability to explain a decision and the ability to turn a feature off are all engineering properties, and an auditor asking to see them will not accept a paragraph.

Product owns the acceptable-use decision. Which applications of AI you will not build, which decisions a model may not make alone, and what a user is told. These are product positions and writing them down is often the first time an organisation has agreed them.

Legal owns the external obligations and the mapping between what the standard asks and what any applicable law requires, which are related and not identical.

Leadership owns the review, and the standard expects documented involvement rather than sponsorship. Minutes with decisions in them, on a cycle.

One person owns the system itself, coordinating all of the above. Where this role is a fraction of somebody's week, the programme survives the first audit and fails the second.

Name all five before the gap analysis, because the gap analysis produces work for each of them and an unassigned action is an audit finding waiting to happen.

What this looks like a year later

The certificate is the start of an obligation, and the second year is where most of the value or most of the regret shows up.

Surveillance audits check that the system is alive, reviewing scope changes, ongoing risk management and incident handling. An organisation that stopped running the process after the certificate will be found out, because the evidence trail simply stops.

New AI systems have to enter the process. Every model, feature or purchased tool added during the year needs its risk assessment and its place in the inventory. Teams that treat this as a gate complain; teams that make it a short, genuinely useful step do not.

Incidents are the evidence auditors most want and organisations least have. Something will go wrong with an AI system during the year. Handling it well and recording what happened, what was decided and what changed is worth more at the next audit than any policy document.

The inventory decays fastest. It is the artefact most likely to be out of date and the first thing an auditor samples, and keeping it current is a small recurring task that needs an owner rather than a reminder.

Budget the maintenance honestly in year one. A programme sized only for achieving certification produces a certificate and then a lapse, which costs more credibility than never having certified at all.

What auditors look for, and where organisations fail

The failure patterns in management system audits are consistent and avoidable.

Documents that describe an aspiration rather than a practice. A policy saying every model is reviewed quarterly, with no evidence of a quarterly review, is worse than a policy saying reviews happen annually and evidence that they do.

An inventory that is out of date. Systems added since the last update, or AI embedded in purchased tools that nobody catalogued, are the commonest finding.

Risk assessments completed once. The method has to have been applied to recent systems, not only to the ones that existed when the programme started.

No evidence of management review. Minutes, decisions, actions. "The leadership team discusses it" with nothing written is not evidence.

Incidents handled informally. If something went wrong with an AI system, the auditor wants the record: what happened, what was decided, what changed. Organisations that handled it well and wrote nothing down fail this.

Shadow systems found during the audit. An AI feature in production that is not in the inventory is the finding that most undermines confidence, because it suggests the inventory process does not work rather than that one entry was missed.

The pattern is that auditors check whether you do what you said, not whether what you said was ambitious. Writing modest, true policies and following them beats writing impressive ones you cannot evidence.

What we would do in the first month

Inventory every AI system, including the embedded ones. This takes longer than expected, surfaces surprises, and is useful whether or not you certify.

Map what you have against the clauses, honestly, and produce a gap list with effort estimates. For an organisation with ISO 27001 the list is usually shorter than a consultant's proposal implies.

Write the scope statement and test it against a real buyer questionnaire. If the scope does not answer the questions you are actually being asked, change it now rather than after the audit.

Name the owner and give them the time, because this is the decision that determines whether the certificate survives its first surveillance audit.

Get several quotes from certification bodies, as published guidance consistently advises, and ask each for the Stage 1 and Stage 2 fees separately.

Our rate band is published: $40 to $100 an hour by role, blending to $60 to $70 for a mixed team, and what we do here is the engineering side: the inventory, the technical controls, the evidence that the oversight you documented is actually implemented in the system. The audit itself is bought from a certification body, and anybody offering to both implement and certify should be declined.