ISO 42001: What the AI Management System Standard Requires, Costs and Who Has It

What ISO 42001 requires: clauses 4–10

ISO 42001 requires an organization to run AI under a management system: clauses 4 to 10 set the mandatory requirements, from defining scope to fixing what goes wrong. Clauses 1 to 3 cover scope, references and terms.

The impact assessment is the part with no direct equivalent in ISO 27001: it asks how an AI system could affect people and society, not just your company.

Annex A: the 38 controls

ISO 42001’s Annex A lists 38 reference controls in nine areas, numbered A.2 to A.10, and you document which ones apply in a Statement of Applicability, per Vanta’s summary of the standard.

The control text itself is in the paid standard. Read the standard before you write your Statement of Applicability, not a summary of it.

ISO 42001 vs ISO 27001

ISO 42001 governs how you build and use AI, while ISO 27001 governs information security; both are certifiable management system standards with the same clause 4–10 structure.

ISO sells the two standards together for CHF 340. Because the clause structure is shared, a company that already runs ISO 27001 can reuse its internal audit and management review routines; see what ISO 27001 certification costs.

How to get ISO 42001 certified

You get ISO 42001 certified by building an AI management system, then passing a two-stage audit by an accredited certification body. The usual path:

1. Set the scope: which AI systems, products and teams.
2. Run a gap assessment against clauses 4–10 and Annex A.
3. Build the system: AI policy, risk and impact assessments, Statement of Applicability.
4. Run an internal audit and a management review before the external audit.
5. Stage 1: the auditor reviews your documents and design. Schellman says the gap to Stage 2 is typically 4 to 12 weeks and shouldn’t exceed six months.
6. Stage 2: the auditor tests whether the system works in practice, then makes a certification decision.
7. Keep it: the certificate lasts three years, with annual surveillance audits.

Choose an accredited body. ANAB, the US accreditation board, launched its ISO 42001 program in January 2024 and lists accredited bodies in its management systems directory. ANAB is clear that ISO 42001 certification covers your management system and does not certify products or services. If a vendor says its AI product is “ISO 42001 certified”, ask for the certificate and its scope.

How much ISO 42001 certification costs

ISO 42001 certification typically costs from several thousand dollars to $75,000 or more for initial certification, according to Vanta, which also notes that ISO publishes no cost benchmark.

Vanta’s own page conflicts on the audit: its table starts at $5,000, its text at $7,000. Vanta sells compliance software, so treat these as estimates. For platform prices, see our comparison of GRC software.

Who is ISO 42001 certified?

AWS, Google Cloud, Anthropic and Microsoft all hold ISO 42001 certification for stated scopes, listed here by announcement date.

A certificate only covers its scope. AWS’s covers four services, not all of AWS.

Is ISO 42001 worth it?

ISO 42001 is worth it for AI vendors selling to enterprises that ask about AI governance, and usually not yet for companies that only use AI tools internally.

Worth it if: you sell an AI product to large customers, you want a recognized way to answer AI governance questionnaires, or you’re preparing governance for the EU AI Act.

Skip it for now if: you use AI internally and no customer has asked. The audit fees and a year of work buy little without a buyer who values the certificate. If customers are asking for a security report first, start with SOC 2, or browse our other compliance guides.

ISO 42001, the EU AI Act and NIST AI RMF

ISO 42001, the EU AI Act and the NIST AI RMF overlap but do different jobs: ISO 42001 is a certifiable standard, the AI Act is EU law, and the NIST AI RMF is a voluntary US framework.

The EU AI Act sets legal duties. Regulation (EU) 2026/1744, published July 24, 2026, moved the high-risk obligations to December 2, 2027 for stand-alone (Annex III) systems and August 2, 2028 for systems embedded in regulated products (Annex I). An ISO 42001 certificate doesn’t make you compliant with the Act.

The NIST AI RMF 1.0, released January 26, 2023, is intended for voluntary use and offers no certificate, like the NIST Cybersecurity Framework for general security.