Does Your Organisation Need ISO 42001 Certification?

AI is entering business processes faster than many organisations can assess its risks. You may already have policies for data protection and security, yet still lack clear AI governance, including who approves an AI tool, checks its outputs and accepts accountability if it causes harm.

ISO 42001 certification can provide independent assurance that your organisation manages AI systematically. It isn't mandatory for every organisation using AI, though. The right decision depends on your risks, your customers' expectations and whether you can maintain the system after the audit.

When ISO 42001 certification makes business sense

ISO/IEC 42001:2023 is the international standard for an Artificial Intelligence Management System (AIMS). As ISO's explanation of the standard sets out, it applies to organisations that develop, provide or use AI systems. ISO 42001 certification is voluntary and involves an independent assessment of the management system within a defined scope.

Customers need independent assurance

A customer may ask how you govern an AI-enabled service before awarding a contract. A questionnaire might be enough for one buyer. Another may make ISO 42001 certification a contractual procurement condition, citing ISO/IEC 42001, rather than a legal requirement.

Check the wording carefully. Does the contract require certification, ask for progress towards it or accept equivalent evidence? Those are different commitments. If several important customers want independent assurance, ISO 42001 certification may be more useful than preparing a separate response for each one.

AI risks affect significant decisions

Formal assurance also deserves consideration when AI influences recruitment, lending, healthcare, safety or access to services. The potential effect on individuals calls for a clear framework for AI governance, effective management systems, oversight, testing and accountability.

The decision isn't based on sector alone. A small company supplying an AI component for a high-impact process may have a stronger case for certification than a large business using an approved tool for low-risk drafting. What matters is what the system does, who could be affected and who relies on your assurance.

When implementing the standard may be enough

You can use ISO/IEC 42001 to improve AI governance without seeking ISO 42001 certification immediately. This may be proportionate when AI use is limited, customers haven't requested a certificate or your organisation first needs to understand its exposure.

Use these questions to guide your decision:

Your position	Sensible next step
A contract explicitly requires ISO 42001 certification	Confirm the required scope and plan for an external audit.
AI affects people or critical operations	Build the AIMS and complete a risk assessment to decide whether independent assurance adds value.
AI use is limited and no customer requires a certificate	Establish controls, then review the certification decision as use grows.
AI tools aren't centrally recorded	Start with an inventory before setting an audit date.

Legal duties are separate. AI use may bring data protection, consumer or sector-specific regulatory requirements. EU-facing activities may also require an EU AI Act assessment. A certificate doesn't replace that legal analysis or establish compliance with every applicable law. Contractual and market expectations can still make voluntary ISO 42001 certification commercially important, without making it a legal requirement.

What an AI management system actually covers

An AI management system (AIMS) brings together the responsibilities, policies, assessments and reviews used to manage AI across the AI system lifecycle. It helps leaders make consistent decisions, with clear accountability and transparency, rather than leaving each team to choose its own controls. ISO/IEC 42001 provides a framework for this work, including for organisations considering ISO 42001 certification.

Scope, ownership and policy

Start by defining which activities, products, teams and locations the system covers. Distinguish between AI you develop, services you provide and third-party tools your staff use. A narrow scope can be sensible, but it must reflect the AI activities covered by the ISO 42001 certification you seek.

Top management must set direction, assign responsibilities and provide resources. The AI policy and supporting policies turn that commitment into operating rules, informed by relevant Annex A controls. They clarify who can approve a use case, what needs assessment, when a system must be reviewed and how concerns are escalated.

A policy alone won't satisfy an auditor. Role-relevant training courses can help staff understand their duties, while records show decisions follow the stated process. Training isn't a certification prerequisite.

Risk and impact assessments

AI risk assessment considers what could go wrong for the organisation and its objectives. An AI system impact assessment examines potential effects on individuals and society, including fairness, privacy and access to services.

For AI-assisted CV screening, the impact assessment would examine the data used, how outputs are checked and whether different groups could be disadvantaged. It would record who can challenge a result and what happens if testing reveals a problem, supporting bias mitigation and ethical AI. If personal data is involved, consider any separate duties under data protection law.

The outcome should lead to decisions, such as human review, testing requirements, limits on use or a decision not to deploy. Record the remaining risk and who accepted it.

A practical route for a lean team

Smaller organisations don't need an oversized governance function. They do need a repeatable process that connects AI uses to owners, risks, controls and evidence. A lean AIMS can support ISO 42001 certification without adding unnecessary layers.

Find the AI you already use

Create an inventory as the starting point for your AIMS, covering approved tools, AI features within existing software and systems developed in-house. For each use, record its purpose, owner, provider, data involved, affected people and role in decision-making.

For example, if staff use Microsoft 365 Copilot, document permitted use cases, who manages access and any relevant training courses. Check what information users can reach before assessing how they might use the tool. An inventory built solely around products you market will miss internal exposure.

A gap assessment against ISO/IEC 42001 can show which practices already exist and where relevant Annex A controls may need attention. It can also help you decide whether ISO 42001 certification is worthwhile. Prioritise high-impact uses rather than writing every document at once.

Apply controls and keep evidence

Annex A provides reference controls covering areas such as AI policies, the AI system lifecycle, data, interested parties and third-party relationships. Use guidance on ISO 42001 Annex A controls to understand these themes, then assess which controls apply to your scope and risks.

For each significant use, connect the assessment to a control and an owner. Evidence might include approval records, supplier reviews and testing for bias mitigation. Keep user instructions, records of completed training courses, incident reports and scheduled review dates too. Where a control doesn't apply, record the reason.

  An AI policy says what should happen. Approval records, assessment results and review findings show whether it happens.  

This approach keeps the workload proportionate. A shared register and existing management meetings may be more useful than new software, provided records stay current and someone follows up actions. Regular reviews can support continual improvement without adding unnecessary process.

Fit ISO 42001 around your existing frameworks

Organisations with ISO/IEC 27001 already have useful processes for risk management, supplier review, internal audit and management review. Reuse them where appropriate rather than running parallel calendars. ISO 27001 information security support can help establish that security foundation.

The standards address different questions. ISO 27001 focuses on information security. ISO 42001 certification also requires attention to AI-specific effects, including bias mitigation, transparency, human oversight and impacts beyond the organisation. A security risk assessment won't automatically answer those questions, which also inform AI governance and ethical AI.

ISO 9001 processes can help with document control, corrective action and performance review. Shared processes are a starting point, not proof that AI requirements have been met. Show where AI decisions are made and how the relevant records are reviewed.

Leadership oversight matters after implementation too. Where a smaller team lacks dedicated governance capacity, virtual CISO support for risk oversight can help maintain ownership of security and compliance actions alongside internal decision-makers.

Preparing for an ISO 42001 certification audit

Before pursuing ISO 42001 certification, define the scope you want audited. Ask prospective certification bodies which activities the audit will cover, what accreditation applies to their service and how surveillance will work. Compare the full commitment, including staff time, preparation, audit fees and ongoing maintenance. Costs vary by organisation, so there’s no reliable single price.

Test readiness before the external audit

Run an internal audit against the standard and your procedures, including relevant Annex A controls. Sample AI uses, rather than reviewing policies alone: can you trace an approval through assessment, controls, testing and later review? This checks whether the AIMS operates and has supporting evidence, not just whether documents exist.

Top management should review the AIMS, including performance, incidents, changes, audit findings and resources. Resolve significant gaps, retain evidence of corrective action and check compliance with your procedures. AKRUP's ISO 42001 consultancy and audit support covers gap assessment, implementation and internal audit preparation.

Know what the auditor will examine

An ISO 42001 certification audit commonly follows two stages. Stage 1 examines documented arrangements and readiness, including the selection of relevant Annex A controls. Stage 2 tests whether the AIMS operates effectively through records and interviews. DNV's overview of ISO/IEC 42001 certification describes how ISO/IEC 42001 addresses AI across the AI system lifecycle.

The certification body, not ISO, issues the certificate. Surveillance audits commonly follow, with recertification often on a three-year cycle. Confirm the arrangements with your chosen body, as audit programmes can differ.

What certification can and cannot demonstrate

A certificate gives customers independent evidence that an AIMS was assessed against ISO/IEC 42001 within its stated scope. ISO 42001 certification can support ethical AI controls, including accountability, transparency and bias mitigation, and strengthen tender responses. BSI's overview of AI management systems also explains the role of structured controls in AI governance.

It doesn't certify every AI product as safe or fair, or prevent all harmful outputs. Nor does it guarantee compliance with every applicable law or regulatory requirements, or cover activities outside the certified scope. When reviewing a supplier's ISO 42001 certification, check what it covers, who issued it and whether the scope includes the service you're buying.

Certification is therefore a point of assurance within an ongoing programme. Changes to models, suppliers, data or intended use still need assessment after the audit.

Key takeaways

• Seek ISO 42001 certification when contractual expectations, material AI risks or the need for independent assurance justify the ongoing work.

• Build the AIMS first: define its scope, assign owners and connect assessments to controls and evidence.

• Treat the certificate as assurance about a management system, and part of ongoing AI governance and continual improvement, not a guarantee about every AI output or legal obligation.

Frequently asked questions

Is ISO 42001 certification mandatory in the UK?

No general UK requirement makes certification mandatory for every organisation using AI. Specific legal duties and regulatory requirements depend on the activity, and may be separate from customer or contract conditions. Check those duties on their own terms.

Do we need ISO 27001 certification first?

No. ISO 27001 can provide useful security processes, but it isn't a prerequisite. Organisations without it can build an AIMS, provided they address the applicable AI management requirements and support compliance decisions with evidence.

Make the decision around your AI use

The starting question is what your AI systems do and who depends on them. That assessment will tell you whether the immediate priority is basic governance, a mature AIMS or independent certification.

A useful certificate follows a working system, not the other way round. If you would like to find out more information or require any of our services please Contact Us.