ISO 42001 certification, done properly

What ISO 42001 is

ISO/IEC 42001:2023, Information technology - Artificial intelligence - Management system, was published on 18 December 2023 by ISO and IEC. It specifies the requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS), and it applies to any organisation, of any size, that provides or uses products or services built on AI (IEC webstore).

It is a management system standard, in the same family as ISO 27001. It won't tell you whether a particular model is safe. It makes you build the process that finds out, decides what to do about it and keeps the evidence. That evidence is what the people asking for it actually want.

Who is asking for it

Two groups are driving most of the conversations we have.

Procurement teams. Large buyers are adding AI sections to supplier due diligence: your AI risk register, your impact assessments, your AI sub-processors and your plan for certification. Procurement teams know how to evaluate an ISO 27001 certified supplier; they don't yet know how to evaluate AI claims on a website. A certificate lets them move from interrogation to verification. We wrote about this in the procurement question that is about to cost you deals.

Audit committees and boards. Non-executives are starting to ask how the company knows the AI it uses, and the AI its suppliers use, won't embarrass it. An AI policy approved in 2024 is not an answer. ISO 42001 gives them auditable evidence instead of a slide deck. See the question your audit committee is about to start asking.

Neither group is helped by a certificate on the wall with nothing behind it. A thin implementation shows within one conversation with whoever owns your AI. That's the argument of ISO 42001 won't save you. Doing it properly might., and it's how we run every engagement.

What certification involves

The standard is aligned to the structure of the other ISO management system standards (BSI Knowledge), with a normative Annex A of reference control objectives and controls, and an Annex D on using it alongside other management systems. In practice, getting certified looks like this.

1. Scope the AIMS. Decide which parts of the business, which AI systems and which roles are in scope, and whether you develop AI, provide it to customers, use it, or all three. Scope drives everything that follows, including the cost and length of the external audit.
2. Build an AI inventory. List every AI system in scope, who owns it and what it does: the models you build, the AI features in software you buy, and the generative AI tools people are already using. Most organisations find systems they didn't know about.
3. Assess AI risk and AI system impact. Run an AI risk assessment and treatment process, and an AI system impact assessment that looks at the consequences for the people and groups affected by each system. The impact assessment is the part that surprises people the first time they meet it.
4. Choose controls and write the Statement of Applicability. Work through the Annex A controls, decide which apply and why, and record it in a Statement of Applicability alongside your risk treatment plan. Annex B gives implementation guidance for each control.
5. Set the AI policy and objectives. Agree an AI policy at leadership level, measurable AI objectives, and clear roles and accountabilities across the AI life cycle, then put the supporting procedures in place.
6. Run an internal audit and management review. Audit the AIMS against the standard yourselves, fix what you find, and hold a management review where leadership looks at the results and decides what changes. This is the evidence the external auditor will ask for first.
7. Stage 1 and Stage 2 audits. A certification body accredited for ISO/IEC 42001 carries out the initial certification audit in two stages: Stage 1 checks you're ready, Stage 2 tests whether the system works in practice. Certification follows a successful Stage 2. In the UK, accreditation comes from UKAS, which granted its first ISO/IEC 42001 accreditation in January 2026 (UKAS).
8. Surveillance audits. The certificate runs on a three-year cycle, with surveillance audits each year and a recertification audit at the end of the cycle (IAF MD 5).

ISO 27001 and ISO 42001 together

ISO 42001 and ISO 27001 share the same harmonised structure: clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation and improvement) follow the same pattern in both. If you already hold ISO 27001, your document control, internal audit, management review and corrective action processes extend to cover AI rather than starting again. If you hold neither, building both at once means one management system and one set of reviews, and you can ask your certification body to audit them together. See ISO 27001 consultancy for how we run the ISO 27001 side.

How long it takes

It depends on scope, and we won't quote a number before we've seen yours. The main factors are how many AI systems are in scope, whether you build AI or only use it, and whether you already run a management system such as ISO 27001. The certification body sets the length of its own audits from your scope and size, and annual surveillance audits are shorter than the initial audit (IAF MD 5). After the gap analysis you get a plan with dates, so you know before you commit.

What it costs

We don't publish an ISO 42001 price, because the work depends on your scope. After a 30-minute scoping call we give you a fixed-price quote for the gap analysis, implementation and audit support, so the number doesn't move once we start. The certification body's audit fees are separate and quoted by them directly.

Why &DEV

&DEV is a UK engineering company, founded in 2019 and based in Cambridge. We secure, certify and run the systems businesses depend on, so the people who scope your AIMS understand how the AI in your products and your tools actually works. When you call, you speak to an engineer, not a salesperson. We're a consultancy, not a certification body: we prepare you for the audit, and an independent accredited body carries it out.

The team includes:

• James Meek, Principal Security Consultant: ISO/IEC 27001 Lead Implementer