ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Choosing an ISO 42001 certification body is the one decision in the project that you cannot fix with better documents. The certificate is only as credible as the organization that issues it, and buyers increasingly check.
Two things decide credibility: whether the certifier is accredited, and whether that accreditation covers ISO 42001. A logo and a low quote prove neither.
This guide explains how accreditation works, how to verify a certifier in minutes, which questions to ask and what the red flags look like. If you are still sizing the project, read the ISO 42001 certification cost guide first.
Free gap assessment
How much of ISO 42001 could you evidence today?
Score every clause and Annex A control of the AI management standard, free, and see where the programme really sits.
Run the free ISO 42001 gap assessment → or View premium report sample
Three standards work together. ISO/IEC 42001 is what you implement. ISO/IEC 17021-1 sets the general rules for any certification body that audits management systems. ISO/IEC 42006 adds the AI-specific requirements for bodies that audit and certify AI management systems.
ISO/IEC 42006 was published in July 2025 as a 31-page standard that supplements 17021-1. It covers areas such as auditor competence, audit time calculation and liability.
National accreditation bodies assess certifiers against these requirements. An accredited ISO 42001 certification body has been independently checked for competence in this field, which is the point of paying for accredited work.
The official description is on the ISO site: ISO/IEC 42006:2025 on iso.org.
An unaccredited certifier can still issue a document that looks like an ISO 42001 certificate. Nothing in the law stops it. What it lacks is independent verification of the certifier itself.
That difference matters at the moment you need the certificate: a customer security review, a tender or a regulator question. Some buyers ask which accreditation body stands behind the certificate, and an unaccredited answer slows the deal.
If your only goal is an internal process improvement, an unaccredited route may be acceptable. If the certificate has to open doors, choose an accredited certifier and write that into your selection criteria.
Choosing an accredited ISO 42001 certification body is the simplest way to protect the value of the certificate.
First, ask the certification body which accreditation body covers its ISO 42001 work. Typical names include UKAS in the UK, ANAB and IAS in the US, RvA in the Netherlands, SCC in Canada, JAS-ANZ in Australia and New Zealand and SAC in Singapore.
Second, open that accreditation body’s public register and search for the certifier. Third, confirm that ISO 42001, or the AI management system scope, is listed, not just ISO 27001 or ISO 9001.
Finally, check the dates. A certifier that gained its AI scope recently may be fully competent, but you should ask how many audits it has completed and how it staffed them.
Ask which accreditation body covers its ISO 42001 scope and when that scope was granted. Ask how many ISO 42001 audits it has completed and whether the audit team has AI technical experience, not just management system experience.
Ask how it calculates audit time and whether it follows the ISO/IEC 42006 approach. Ask what each stage involves, how nonconformities are classified and what the appeal process is.
Ask who will audit you, whether you can see their competence, and how conflicts of interest are handled. Ask about surveillance audit frequency, recertification and what happens if you change scope.
Finally, ask for the full price schedule, including surveillance years and travel, and for two references in your sector.
| Check | Why it matters | Where to verify |
|---|---|---|
| Accreditation body named | Independent proof the certifier is competent | Certifier website and certificate |
| ISO 42001 in accreditation scope | General accreditation is not enough | Accreditation body register |
| AI audit experience | Competence in AI topics | Audit team profiles and references |
| Audit time method | Prevents under-scoped audits | Quote and ISO/IEC 42006 approach |
| Three-year pricing | Avoids surveillance surprises | Written fee schedule |
ISO/IEC 42006 changed audit time calculation and competence requirements between draft and final versions. A certifier that quotes very little audit time for a complex AI estate is signalling a thin audit.
Competence matters because auditors have to evaluate things like impact assessments, data governance and AI system lifecycle controls. A generalist who only knows clause text will miss real weaknesses, and the wrong kind of audit gives you false comfort.
Ask to see the audit team profile before you sign, and push for at least one auditor who has worked with AI systems directly.
Quotes differ in what they include. Compare stage 1 and stage 2 audit days, the surveillance years, travel and any fees for report review or certificate issue.
Be careful with low headline prices. A cheaper first-year audit can hide higher surveillance fees or thinner audit time. Total the three-year cost for each option.
Our certification timeline guide shows how the stages fit together, which helps you check that quoted audit days match the work.
Watch for guaranteed pass promises, certificates issued with very little audit time and refusal to name an accreditation body. Another warning sign is a certifier that also sells you the consulting and then audits the result.
Be wary of certifiers that cannot show AI audit experience or that rely entirely on remote document review for a complex system. A credible audit sees how systems operate.
If anything feels too easy, it probably is. The certificate will not carry the weight you need.
Accredited certification bodies are not allowed to provide consultancy to clients they certify. Keep the roles separate: a consultant helps you prepare, and the certifier assesses you independently.
If a vendor offers certification and implementation in one package, ask how independence is protected. A package can be legitimate when different organizations deliver each part.
Decide your preparation route early. Some organizations use templates and internal staff, while others buy support. Either way, the certificate itself must come from an independent body.
Finish your scope statement, a first risk assessment and a gap analysis. Certifiers quote more accurately when they see a defined scope and an honest gap list. The ISO 42001 gap analysis guide shows how.
Free AI risk assessment
Which of your AI systems could harm people, or you?
List your AI systems, models and data, pick from 38 AI risk scenarios, rate them for the people affected and for you, and plan treatment with ISO 42001 Annex A controls. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free AI risk assessment → or View premium report sample
Collect the facts they will ask about: number of AI systems, locations, employees involved in AI and any existing certificates such as ISO 27001. Existing certificates can reduce effort through integrated audits.
Then request quotes from at least three accredited bodies, so you can compare scope, audit time and experience.
Our toolkit covers the documents a certifier will ask for, so the ISO 42001 Toolkit lets you prepare before the first call.
Score each certifier from one to five on accreditation scope, AI audit experience, audit team competence, pricing transparency, responsiveness and sector references. Weight accreditation and competence highest.
Do a short call with each shortlisted certifier and note how clearly they answer. Clear answers about accreditation and process predict a smoother audit.
Make the final decision with top management, because the certifier becomes a long-term relationship across surveillance cycles.
A written scorecard also records why you chose the ISO 42001 certification body, which helps if anyone later challenges the decision.
Your certifier shapes the calendar. Stage 1 and Stage 2 dates depend on its capacity, and the best ISO 42001 certification body options book months ahead. Lock dates once your implementation plan is realistic.
The certifier also shapes your evidence. Ask what records it expects for the impact assessment and the internal audit, so you do not discover gaps during Stage 2.
Finally, ask what a surveillance audit looks like. Certification runs across a multi-year cycle with annual checks, so you are choosing a long-term partner, not a one-off supplier.
Picking carefully now means fewer surprises later and a certificate that carries weight with customers.
Engage a shortlist once your scope is fixed and your gap analysis is done, usually a few months before you want Stage 1. Earlier is fine for quotes, but certifiers need a defined scope to give a firm figure.
Book Stage 1 only when the core documents exist and an internal audit and management review are scheduled. A premature audit wastes money and delays certification.
Treat the first conversation as a two-way test. A good ISO 42001 certification body asks about your AI systems, your risks and your timeline, and explains its own process without hiding behind jargon.
The standard does not oblige you to use an accredited body, but buyers and regulators often expect it. Accreditation is the main independent proof that the certifier is competent.
ISO/IEC 42006:2025 sets AI-specific requirements for bodies that audit and certify AI management systems. It supplements ISO/IEC 17021-1.
Accredited certification bodies cannot consult for clients they certify. Keep implementation support and certification separate.
Look for both the certifier and the accreditation body on the certificate, then confirm the certifier’s scope on the accreditation body register.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026