Resources / Reference
ISO/IEC 42001 Buyer’s Guide
What ISO/IEC 42001 certification costs, how long it takes, and how to choose a consultant.
The short answer
Most organizations reach ISO/IEC 42001 certification in roughly four to twelve months, starting with a gap assessment. Organizations that already hold ISO/IEC 27001 or ISO 9001 usually move faster, because ISO/IEC 42001 shares their management system structure. Consulting and certification audit fees are separate.
What it costs
| Stage | Our starting price | What drives the cost |
|---|---|---|
| Gap assessment | From $7,500 | Number of AI systems in scope and existing management systems |
| Implementation | From $15,000 | Size of the gaps, documentation needed, and internal capacity |
| Internal audit | From $5,000 | Scope of the AI management system |
| Certification audit | Paid to the certification body | The body you choose and the size of the audit |
How long it takes
Gap assessment
About four to six weeks to measure your current practice against every clause and Annex A control.
Implementation
Typically three to six months to build the policies, processes, and records the standard requires.
Internal audit and management review
Two to four weeks, completed before the certification audit.
Certification audit
A Stage 1 review of your documentation, then a Stage 2 audit of how the system works in practice.
How to choose a consultant
- Credentials: look for ISO/IEC 42001 Lead Auditor or Lead Implementer training and experience with management system audits.
- Independence: the consultant who helps you prepare can’t also be your certification auditor. Certification bodies must stay independent of consulting.
- Clear pricing: ask for written pricing for the gap assessment and a scoped estimate for implementation.
- Ownership: confirm you own every document and record the consultant produces.
- Industry knowledge: your AI management system has to reflect the laws that apply to your industry, not just the standard.
- Candor: a good consultant will tell you if documented alignment is enough and certification isn’t worth it yet.
Ready to start? See our ISO/IEC 42001 Gap Assessment.
This page is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.