What is ISO 42001?
ISO/IEC 42001 is the world's first certifiable management system standard for Artificial Intelligence. Published in late 2023, it gives organisations a framework to develop, provide and use AI systems responsibly, addressing risk, transparency, accountability and continual improvement.
It follows the familiar Annex SL management-system structure and introduces AI-specific controls covering impact assessment, data governance, lifecycle management and human oversight. It is designed to integrate with ISO 27001 where information security is also in scope.
For UK organisations, ISO 42001 is emerging as a way to demonstrate responsible AI governance to customers and regulators, and to prepare for evolving AI assurance expectations. As a new standard, the UK accredited-certification market for it is still maturing.
How to get ISO 42001 certified
- Define the scope of your AI management system and identify the AI systems in use.
- Conduct AI risk and impact assessments and set a responsible-AI policy.
- Implement AI-specific controls covering data, transparency, oversight and lifecycle.
- Operate the system and gather governance evidence.
- Run internal audits and management review.
- Certify with an accredited body offering ISO 42001 (a growing but still limited pool), and maintain via surveillance and three-yearly re-certification.
Choosing a certification body
For a certificate to carry weight, choose a body accredited by UKAS, the UK's national accreditation body. Accredited certification is recognised by customers and procurement teams; unaccredited certificates often are not. Get quotes from at least three bodies, as fees vary.
How much does ISO 42001 certification cost?
There is no single price — total cost depends on your organisation's size, how much you already have in place, the number of sites, and whether you use a consultant. Broadly, the cost splits into three parts: implementation (building the system), the certification audit (paid to the certification body), and ongoing costs (annual surveillance and a three-yearly re-certification).
- As a new standard, fewer certification bodies are accredited, which can affect availability and price.
- Strong synergy with ISO 27001 means organisations already certified to 27001 face lower incremental cost.
- AI impact assessments and governance documentation are the main internal effort drivers.
To get a tailored figure for your organisation, use our free calculator:
Open the ISO 42001 cost calculator →