ISO 42001 Gap AssessmentISO 42001 certification
ISO/IEC 42001 certification means an accredited certification body has audited your AI management system and issued a certificate. The first cycle has two audit stages, the certificate runs for three years, and surveillance audits follow in years two and three. One accredited body, Schellman, publishes first-year audit fees in the $20,000s to $40,000s.
The certification process, step by step
- Build and run the AI management system. Auditors look for a system that is operating, not only written down: AI risk and impact assessments carried out, controls chosen from Annex A and recorded in a Statement of Applicability, objectives tracked, an internal audit (clause 9.2) and a management review (clause 9.3) completed. The gap assessment scores all 27 clause requirements and 38 Annex A controls so you can see what is missing.
- Choose an accredited certification body. Accreditation means an accreditation body has assessed the certifier itself. Examples with ISO/IEC 42001 accreditation: Schellman (ANAB, September 2024), SGS (ANAB, April 2025) and BSI (ANAB, UKAS and RvA, March 2026). Since July 2025, ISO/IEC 42006 sets the additional requirements for bodies that audit and certify AI management systems, on top of ISO/IEC 17021-1.
- Stage 1 audit. The certifier reviews how your management system is designed and documented and whether you are ready for the second stage.
- Stage 2 audit. The certifier tests whether the system works in practice, using your records and interviews. Successful completion leads to the certificate.
- Surveillance in years two and three. According to Schellman, the certificate lasts three years and annual surveillance reviews check that the system keeps operating and keeps meeting the standard.
- Prove it to customers. Accredited certificates can be checked on IAF CertSearch, the International Accreditation Forum's validation service.
ISO 42001 certification cost
Certification bodies quote per organisation, because the audit effort depends on your scope. Schellman is the only accredited body we found that publishes figures:
| Audit | Published fee (USD) |
|---|---|
| Year 1: Stage 1 and Stage 2 | $20,000s to $40,000s |
| Year 2: surveillance | $13,000 to $20,000+ |
| Year 3: surveillance | $13,000 to $20,000+ |
| Three-year cycle, audit fees only | from about $46,000 (our sum of the lowest figures) |
Source: Schellman's ISO 42001 FAQ, published 24 February 2025 and updated 23 June 2026. Other certification bodies' fees will differ; ask two or three for a quote on the same scope.
Costs on your side
- The standard itself, sold by ISO and national standards bodies.
- Staff time to run the risk and impact assessments, keep records, carry out the internal audit and the management review.
- Outside help or training, if you use it.
- Tools or templates for the documents and records below.
What to have ready before Stage 1
These 17 documents and records come straight from the clauses (our summary). Tick them off and download the list on the ISO 42001 checklist.
- Scope of the AI management system (clause 4.3): Which AI systems, teams, sites and activities are in and out, and why.
- AI policy (clause 5.2): Approved by top management, with commitments to meet requirements and to improve; shared with staff.
- AI risk assessment method (clause 6.1.2): How AI risks are identified, analysed and rated, and when a risk is acceptable.
- AI risk treatment plan (clause 6.1.3): The treatment chosen for each AI risk, its owner and the controls that implement it.
- Statement of Applicability (clause 6.1.3): Every Annex A control marked included or excluded, with the reason and its status.
- AI system impact assessment process (clause 6.1.4): How you assess consequences for individuals, groups and society, and when you repeat it.
- AI objectives (clause 6.2): Measurable objectives with owners, resources, deadlines and how results are evaluated.
- Evidence of competence (clause 7.2): Skills needed for AI roles, and training, experience or qualification records that show them.
- Document control (clause 7.5): How documents are approved, versioned, stored, protected and retired.
- Operational records (clause 8.1): Records showing AI processes ran as planned, including outsourced ones.
- AI risk assessment results (clause 8.2): Dated assessments for each AI system in scope, repeated after significant change.
- AI risk treatment results (clause 8.3): Status of each treatment action and whether it worked.
- AI system impact assessment results (clause 8.4): Completed assessments for the AI systems in scope, kept for a defined period.
- Monitoring and measurement results (clause 9.1): What you measured, when, the results and what you concluded.
- Internal audit programme and reports (clause 9.2): The audit plan, auditors' independence, findings and follow-up.
- Management review records (clause 9.3): Inputs considered, decisions taken and actions agreed by top management.
- Nonconformity and corrective action log (clause 10.2): What went wrong, the root cause, the action taken and whether it was effective.
Paid options
AI Governance Toolkit (instant download)
AI Governance Toolkit Starter
$199 one-time
AI use and governance policy (Word), AI system inventory and risk register (Excel), AI system risk assessment (Excel) and a 30-day start-here plan.
AI Governance Toolkit Professional
$599 one-time
Everything in Starter, plus an ISO/IEC 42001 gap assessment workbook, a NIST AI RMF mapping, AI vendor contract clauses and a days 31–90 plan toward an ISO/IEC 42001 certification audit.
Pay by card · instant download · all sales final (refund policy)
Prices in US dollars.
Questions
Who can certify an organisation to ISO 42001?
A certification body that an accreditation body has assessed for ISO/IEC 42001, such as one accredited by ANAB in the US or UKAS in the UK. Since July 2025, ISO/IEC 42006 sets the extra competence and audit rules those bodies follow. Consultants and software tools can help you prepare, but they cannot issue an accredited certificate.
How much does ISO 42001 certification cost?
Fees are quoted per organisation and scope. Schellman, an ANAB-accredited body, publishes typical figures: $20,000s to $40,000s for the Stage 1 and Stage 2 audits in year one, then $13,000 to $20,000+ for each of the two surveillance years. Your own staff time, any outside help and the standard itself come on top.
How long is an ISO 42001 certificate valid?
Three years. Schellman describes annual surveillance reviews in years two and three to confirm the management system is still working and still meets the standard.
Is ISO 42001 certification required by law?
No. ISO/IEC 42001 is a voluntary standard. Customers may ask for it in contracts or questionnaires, and it can support work on laws such as the EU AI Act, but a certificate on its own doesn't show that you meet any law.
Does this site certify organisations?
No. The gap assessment and checklist here are free self-assessments that show what to fix before an internal audit or a certification body's audit.
Sources
- Schellman, ISO 42001: the most frequently asked questions: published 24 February 2025, updated 23 June 2026.
- Schellman, first ISO 42001 ANAB-accredited certification body: 24 September 2024.
- SGS, new ANSI ANAB accreditation for ISO/IEC 42001: 29 April 2025.
- BSI secures ANAB accreditation to certify ISO/IEC 42001: 10 March 2026.
- ISO/IEC 42006:2025 (ISO): edition 1, published July 2025, 31 pages; requirements for bodies that audit and certify AI management systems, building on ISO/IEC 17021-1.
- ISO/IEC 42001:2023 (ISO): edition 1, published December 2023, 51 pages, ISO/IEC JTC 1/SC 42.
- IAF CertSearch (certificate validation): International Accreditation Forum.
- Each source was opened and checked on 1 October 2026.