ISO 42001 certification, run end to end
From gap assessment to certificate: we scope and build your AI management system, run the internal audit, and sit with you through Stage 1 and Stage 2 with your certification body. Fixed fee agreed up front, delivered by consultants holding ISO/IEC 27001 and ISO/IEC 42001 Lead Auditor certifications.
What is ISO 42001 certification?
ISO 42001 certification is independent confirmation by an accredited certification body that your AI management system (AIMS) meets ISO/IEC 42001:2023, the world's first AI management system standard, published in December 2023. The body audits the AIMS in two stages, Stage 1 (documentation) and Stage 2 (implementation), and the certificate is valid for three years with annual surveillance audits.
Who this is for
When ISO 42001 certification is the ask
Certification is usually a commercial requirement before it is a technical one. If any of these sound familiar, this is the engagement.
An enterprise customer asks how you govern the AI in your product, and a policy PDF no longer answers it.
A government or enterprise tender asks for evidence of responsible AI governance from suppliers.
You sell into Europe and want governance evidence that lines up with where the EU AI Act is heading.
You already hold ISO 27001 and want to extend the same governance discipline to AI.
An investor, acquirer or insurer wants independent assurance of how you build and run AI.
What you receive
What the engagement includes
Everything your certification body will ask for, built and evidenced before they arrive.
AIMS scope & design
A defensible AIMS scope (clause 4.3) covering the AI systems you develop, provide or use, the AI policy and the risk methodology, matched to how your organisation actually builds and runs AI. Scope is the decision that most affects cost, and a narrow, defensible one certifies faster.
AI risk assessment & Statement of Applicability
A facilitated AI risk assessment covering bias, transparency, explainability, data quality and accountability, a treatment plan, and the Statement of Applicability with a justification for every inclusion and exclusion.
Policy & control implementation
Policies written for your environment rather than a template, controls implemented with named owners, and evidence collection set up so it survives the audit, not just the project. Where an ISMS already exists, we extend it rather than duplicate it.
Staff awareness
Awareness training so the AIMS keeps running outside audit week. Auditors interview your staff, and prepared staff are the difference between a smooth Stage 2 and a painful one.
Pre-certification internal audit
The clause 9.2 internal audit your certification body expects to see, run the way they run theirs, with findings closed before Stage 1.
Stage 1 & Stage 2 audit support
We shortlist and brief the certification body, sit in both audits with you, and manage any nonconformities through to the certificate.
The process
How the engagement runs
Typical elapsed time from kick off to certificate is two to four months where an ISO 27001 ISMS already exists, and four to eight months from a standing start. Certification body booking lead times affect the end date, so we shortlist early.
Weeks 1–2
Gap assessment
We inventory the AI systems in scope, benchmark your current governance against ISO/IEC 42001:2023, and rank what blocks certification, what carries real risk, and what is merely tidy. The fixed-fee quote for the build follows from this.
Weeks 3–6
Design & risk
AIMS scope, AI policy, risk methodology, the facilitated AI risk assessment and the Statement of Applicability.
Months 2–4
Implementation
Controls, policies, evidence collection and staff awareness, implemented with your team and your AI and engineering leads rather than around them.
Before Stage 1
Internal audit & management review
The clause 9.2 internal audit and the management review, with findings closed while they are still cheap to close.
Certification
Stage 1 & Stage 2
Your certification body audits the AIMS in two stages. We attend both, and manage any nonconformities through to the certificate.
Already certified to ISO/IEC 27001? The two standards share the same management-system structure, so your existing ISMS documentation, internal audit cycle and management review carry over, and the work shortens accordingly. Our guide on ISO 42001 vs ISO 27001 explains what carries over and what does not.
Pricing
What ISO 42001 certification costs
One fixed consulting fee, quoted in writing after the gap assessment. No hourly billing.
The total cost of certification has three lines, and only one of them is ours: our fixed consulting fee, the certification body's audit fees (paid to them, varying by body and scope), and your own team's time. Because ISO 42001 builds on the same management-system structure as ISO 27001, an existing ISMS reduces all three.
The consulting fee is fixed by scope, which is why every engagement starts with a cybersecurity gap analysis: you get a ranked remediation plan and a fixed quote for the build. If you want a read on where you stand first, the free ISO 42001 readiness assessment takes a few minutes.
Independence
You choose the certification body. We do the rest.
Consultants prepare you; certification bodies certify you. The two roles are kept separate so the certificate means something, and we never issue certificates ourselves. In Australia, JAS-ANZ, the government-appointed accreditation body, has accredited certification bodies for ISO/IEC 42001 since December 2024. The pool of accredited bodies is still growing, so confirm the accreditation covers ISO/IEC 42001 specifically, not just ISO 27001 or ISO 9001.
We help you shortlist bodies by AI audit experience, scope fit and booking availability against your deadline, brief the one you pick, and sit with you through Stage 1 and Stage 2.
Why CyberNinja
Why organisations choose us
Auditors build your AIMS
Our consultants hold ISO/IEC 27001 and ISO/IEC 42001 Lead Auditor certifications, so the AIMS is built the way it will be audited.
Built on your ISMS, not beside it
ISO 42001 and ISO 27001 share the same management-system structure, so an existing ISMS shortens the work. We extend your current documentation, audit cycle and management review rather than running a parallel system.
Independent advice
We hold no reseller agreements and take no vendor margin, and we never issue certificates. The advice you get is the advice that fits you.
Fixed scope, fixed fee
The engagement is scoped with you after the gap assessment and quoted as a fixed fee in writing. No hourly billing, no surprise extras.
Want the standard itself first? Our ISO 42001 framework guide explains what an AIMS must show, and our implementation blueprint walks through a rollout step by step.
FAQ
ISO 42001 certification FAQs
Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.
Ready to get certified?
Tell us who is asking for certification and when they need it. We will scope the work and give you a fixed price, so you know the cost before you commit.