ISO 42001 certification — cost, timeline, and what auditors actually look for

What ISO 42001 actually is

ISO/IEC 42001:2023 is the first certifiable AI Management System standard. Think ISO 27001 but for AI risk. Published December 2023, certification bodies began issuing it mid-2024, and adoption is compounding fast — search volume up 83% year-over-year, with the AI Act + NIST AI RMF push driving most of it.

Unlike NIST AI RMF (a framework you self-attest to), ISO 42001 is certifiable by accredited auditors. That makes it the defensible choice for buyers and regulators — you can hand them a certificate and a Statement of Applicability instead of arguing about your own assessment.

Real cost

• Readiness assessment + program build: $80K-$200K fixed-fee for a mid-market AI-shipping company.
• Certification body Stage 1 + Stage 2 audit: $25K-$60K depending on scope and certification body (Schellman, BSI, A-LIGN, NQA all issue ISO 42001).
• Internal program ownership (Year 1): 1.0 FTE equivalent if running standalone, ~0.3 FTE if running alongside ISO 27001 / SOC 2.
• Surveillance audits (Years 2-3): $15K-$30K each.
• Recertification (Year 3): $25K-$50K.

Total over 3 years: $155K-$370K. Inside a Modernization Partnership: bundled at no separate line item.

Realistic timeline

• Months 1-2: AI inventory + use-case classification. Most firms underestimate this. We've seen 30+ AI use cases in companies that thought they had three.
• Months 2-4: Risk management system per Clause 6. Statement of Applicability. AI policy framework.
• Months 4-7:Operations — clauses 7-10. Roles + responsibilities, training, documented procedures.
• Months 7-9: Internal audit + management review. Identify gaps + remediate.
• Month 9: Certification body Stage 1 (documentation review).
• Month 11-12: Stage 2 audit (on-site or remote). Certification issued.

What auditors actually look for

1. AI use-case inventory and risk classification. Documented, dated, version-controlled, reviewed quarterly.
2. Statement of Applicability (SoA) mapping every Annex A control to your environment with justification for inclusions / exclusions.
3. Risk management system— not a one-time assessment, an ongoing process with documented review cadence.
4. Roles + responsibilities assigned to named individuals. AI committee or governance board with documented charter.
5. Training records for every person handling AI systems.
6. Vendor + third-party AI risk management— with actual contractual flow-down language to AI vendors.
7. Incident response procedures for AI-specific events (model misbehavior, training-data leak, prompt injection at scale).
8. Internal audit conducted by independent personnel with documented findings + closure.

The crosswalks that matter

ISO 42001 + NIST AI RMF + EU AI Act share roughly 70% of evidence. Companies pursuing all three at the same time save 40-50% versus running them sequentially. Companies that already have ISO 27001 share another ~40% of evidence with the security controls.

Most of our AI consulting engagements run ISO 42001 + NIST AI RMF as a single program with EU AI Act conformity overlaid for clients with EU exposure. Document once, certify three times.

What ISO 42001 doesn't do

• It's not a security audit. ISO 27001 still required for most B2B SaaS contracts.
• It's not EU AI Act conformity. Covers ~70% of the evidence requirements but Article 43 conformity assessment is its own track.
• It's not a substitute for AI red-teaming. The standard requires you to manage AI security risk; it doesn't tell you how to test for prompt injection or model exfiltration.