AutomateWisely Editorial Team · Last reviewed October 31, 2026 · How we research
Security questionnaires used to stop at SOC 2 and ISO 27001. Many now carry a new section, and it tends to look like this:
- Who approves new uses of AI in your company?
- How do you assess the risks and impacts of an AI system before launch?
- How is customer data used to train or prompt models?
- What happens when an AI feature gives a wrong or harmful output?
ISO/IEC 42001 is the international standard that turns your answers to those questions into one auditable system, and one certificate you can attach instead of writing four essays.
- Published
- December 2023, by ISO and IEC
- Type
- Certifiable management system standard, voluntary
- Who it fits
- Any organization that develops, provides or uses AI
- Requirements
- Clauses 4 to 10, plus 38 reference controls in Annex A
- Certificate
- Three years, with surveillance audits in between
- Auditor rules
- ISO/IEC 42006, published July 2025
How the standard is built
ISO 42001 uses the same skeleton as ISO 27001 and ISO 9001. If you have run either, the shape will be familiar: plan, do, check, improve, and keep records that prove it.
- 4Context. Your role (developer, provider, user), stakeholders and the scope of the system.
- 5Leadership. An AI policy approved at the top, and named roles.
- 6Planning. AI risk assessment, AI system impact assessment and objectives.
- 7Support. People, skills, awareness and controlled documents.
- 8Operation. Running the assessments and controls across the AI life cycle.
- 9Evaluation. Monitoring, internal audit and management review.
- 10Improvement. Nonconformities, corrective action, continual improvement.
Annex A: 38 controls in nine areas
You pick the controls that apply, justify any you exclude and record the choice in a Statement of Applicability, exactly as in ISO 27001.
Numbers in the corner are controls per area. Annex B gives implementation guidance, Annex C lists AI objectives and risk sources, and Annex D covers use across sectors.
Do you actually need it?
Worth it now
- You sell an AI product or AI features to enterprise buyers
- You use AI in hiring, lending, insurance or health decisions
- You build or fine tune models, not just use them
- You already hold ISO 27001 and can extend it
Probably not yet
- You only use mainstream AI tools internally
- No customer or regulator is asking for evidence
- Nobody could own the system for at least a few hours a week
Start with an AI use policy and an inventory instead. They are the first steps of ISO 42001 anyway.
Some of the earliest certified organizations were AI providers themselves: AWS announced accredited ISO 42001 certification in November 2024 and Anthropic in January 2025.
The route to a certificate
- Inventory and gap assessmentList every AI system you build, sell or use and compare current practice with the clauses.
- Scope and policyDecide which products, systems and locations are in scope; get the AI policy approved.
- Risk and impact assessmentsAssess each in scope system, choose Annex A controls, write the Statement of Applicability.
- Run it and keep recordsCertification bodies such as NQA expect at least three months of the system operating before the audit.
- Internal audit and management reviewBoth must be complete before the certification audit.
- Stage 1 and Stage 2 auditsStage 1 reviews documents and readiness; Stage 2 tests whether the system works in practice.
- Certificate, then surveillanceSurveillance audits in years two and three, recertification at year three.
Choose a certification body accredited for ISO 42001 by a national accreditation body, such as ANAB in the US or UKAS in the UK. A certificate from an unaccredited issuer carries little weight with buyers.
What it costs: the honest spread
There is no independent cost benchmark yet. The SOC 2 Auditors Directory said so in its October 2026 review and collected what auditors and platforms publish instead. The spread is wide because each figure covers something different:
Figures as collected by the SOC 2 Auditors Directory, updated October 6, 2026. Advisory led programs for 50 to 200 person companies were quoted far higher, which shows how much outside help changes the bill. Your own staff hours come on top in every case.
Audit fees follow audit days, and audit days follow how many people work on AI and what role you play. That is why the readiness check includes an audit day lookup.
Check your readiness
Answer honestly for the scope you would certify. The result shows which clauses are weakest and how many audit days to expect.
Audit days from Sensiba’s published estimate table (September 2025); they are estimates, not prices. Nothing you answer is stored or sent.
ISO 42001 next to the other frameworks
| ISO 42001 | EN 18286 | NIST AI RMF | ISO 27001 | SOC 2 | |
|---|---|---|---|---|---|
| What it is | AI management system | Quality system for AI Act providers | US risk framework | Security management system | Attestation report |
| Certifiable | Yes | Used in conformity assessment | No | Yes | Report, not certificate |
| Mandatory | No | No, but gives presumption of conformity | No | No | No |
| Focus | Governing AI across its life cycle | EU AI Act Article 17 and 11 | Govern, Map, Measure, Manage | Information security | Controls at service providers |
For the AI Act itself, see EU AI Act explained and the EU AI Act compliance checklist. If you already run SOC 2, many controls and much of the evidence can be reused; several SOC 2 platforms also support ISO 42001.
Common questions
Is ISO 42001 required by law?
No. It is voluntary everywhere. Buyers, not regulators, are what usually make it necessary.
Can we certify only one product?
Yes. The scope can be a single product or business unit, as long as the boundary is clear and justified.
We only use AI tools from vendors. Does it still apply?
It can. “AI user” is one of the roles the standard covers. Your controls then focus on use, suppliers and impacts rather than model development.
Does ISO 27001 make it faster?
Usually. Document control, internal audit, management review and supplier management already exist, and many certification bodies run integrated audits.
How long is the certificate valid?
Three years, with surveillance audits in years two and three and a recertification audit at the end.
If you remember three things
Sources
- ISO, ISO/IEC 42001:2023 Artificial intelligence, Management system
- SOC 2 Auditors Directory, How much will ISO 42001 cost your organization? (updated October 6, 2026; compiles Vanta, Schellman, Sensiba and NQA figures)
- Orrick, First harmonised technical standard published under the EU AI Act (October 27, 2026)
- NIST, AI Risk Management Framework
General information, not legal or certification advice. Spotted an error? Tell us.