ISO/IEC 42001 certification for AI companies
We run accredited ISO/IEC 42001 certification for companies that develop, provide or use AI systems. The certificate is issued by our partner body LL-C, accredited by ANAB for ISO/IEC 42001. If LL-C certifies, or will certify, your ISO/IEC 27001 system, both standards can be audited together. Stage 1 is usually remote; the audit language is agreed in the quote. Prices start from EUR 1,150 net (PLN 4,900) for a team of up to five. We certify; we do not implement or consult on the system we audit.
What you get certified against.
ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system: policy, roles, AI risk assessment, AI system impact assessment and controls across the AI system life cycle.
- Standard
- ISO/IEC 42001:2023 — Artificial intelligence — Management system
- Controls
- Annex A reference controls; applicability is decided in your Statement of Applicability
- Certification body
- LL-C (Certification) Czech Republic a.s., accredited by ANAB (ANSI National Accreditation Board) for ISO/IEC 42001, accreditation ID MS-5294
- Audit rules
- ISO/IEC 17021-1; remote activities according to Global ACI-TECH-3-003
- Validity
- 3 years, with a surveillance audit every year
What you should know before you ask for a quote.
Four points that decide the scope, the audit days and what the certificate can prove.
- 01
Scope follows your role in the AI system
ISO/IEC 42001 asks the organisation to determine its roles in relation to AI systems, for example as a provider, producer or customer of AI. The scope of the certificate names the AI systems and activities covered.
- 02
Certification does not replace the AI Act
Regulation (EU) 2024/1689 sets legal obligations that depend on the risk class of the AI system and your role. An ISO/IEC 42001 certificate shows that you manage AI risks systematically; it does not by itself demonstrate conformity with the regulation.
- 03
One audit with ISO/IEC 27001
ISO/IEC 42001 and ISO/IEC 27001 share the common structure of ISO management system standards. If you already hold, or plan, ISO/IEC 27001, both can be assessed in an integrated audit by one team.
- 04
Remote and on-site activities are set in the audit plan
For teams that build and run models in the cloud, the certification body sets the remote and on-site activities in the audit plan according to Global ACI-TECH-3-003 (formerly IAF MD 4:2025).
From inquiry to certificate.
Stage 2 can follow stage 1 closely when stage 1 confirms that your AI management system is ready. The number of audit days is set in the quote.
- 01 1–2 days
Inquiry & quote
You send the scope, headcount, sites, AI systems and your role in them. We quote the full three-year cycle.
- 02 about 1 week
Contract & audit plan
Contract signing, assignment of an audit team competent for AI management systems, agreement on remote tools.
- 03 usually remote
Stage 1 audit
Review of the scope, AI policy, AI risk assessment, AI system impact assessment and Statement of Applicability.
- 04 remote or on-site
Stage 2 audit
Evaluation of how the controls work across the AI system life cycle, according to the audit plan.
- 05 2–3 weeks
Certificate
After any nonconformities are closed: certification decision by a person who did not take part in the audit, then issue of the accredited certificate.
What it costs.
Audit days depend on the number of people doing work within the scope and the complexity of the AI systems covered.
- Certification audit, stage 1 and stage 2from EUR 1,150 net (PLN 4,900)
- Surveillance audit, each yearfrom EUR 920 net (PLN 3,900)
- Recertification after three yearsfrom EUR 1,150 net (PLN 4,900)
Prices apply to an organisation of up to five people in one location and one standard. On-site audits add travel and accommodation at actual cost; remote activities do not. The quote covers the full three-year cycle.
What we need for a quote.
With them we calculate audit days and tell you which activities can be remote.
- 01 AI systems in scope and what they are used for
- 02 Your role for each system, for example AI provider, AI producer (developer) or AI customer using third-party models
- 03 Preferred audit language
- 04 Number of people doing work within the scope, including contractors
- 05 Sites and work done only online
- 06 Whether you hold or plan ISO/IEC 27001
- 07 Current AI policy, risk assessment and Statement of Applicability, if available
Questions from AI teams.
Who issues the certificate?
The certificate is issued by our partner certification body LL-C (Certification) Czech Republic a.s., accredited by ANAB (ANSI National Accreditation Board, USA) for ISO/IEC 42001 since November 2025, accreditation ID MS-5294. ISO/IEC 42001 is not yet a sub-scope of the Global ACI multilateral recognition arrangement, so recognition of the certificate rests on the ANAB accreditation itself.
Does ISO/IEC 42001 certification make us compliant with the AI Act?
No. The AI Act (Regulation (EU) 2024/1689) is law; ISO/IEC 42001 is a voluntary standard. The management system helps you organise risk management, documentation and oversight of AI, but obligations under the regulation must be checked for each AI system separately.
We only use third-party models such as a large language model through an API. Is ISO/IEC 42001 relevant?
It can be. The standard covers organisations that develop, provide or use AI systems. The scope then focuses on how you select, integrate, monitor and control the models you use.
How is the price calculated?
Audit days depend on the number of people doing work within the scope and the complexity of the AI systems. For organisations of up to five people in one location, the certification audit starts from EUR 1,150 net (PLN 4,900) and each surveillance audit from EUR 920 net (PLN 3,900).
Do you help implement the system?
No. A certification body may not offer or provide management system consultancy (ISO/IEC 17021-1, clause 5.2). You can implement the system yourself or with an independent consultant; we audit and certify it.