ISO/IEC 42001 is an international standard for an AI management system, meaning the policies, roles and controls an organisation uses to run AI responsibly. You can be certified against it by an accredited certification body. The route is a gap analysis, building the system, an internal audit, then a two-stage external audit, followed by surveillance. What it costs depends on your scope, not on a standard price.
Last reviewed: 17 October 2026. Facts checked. iso.org returned 403 on both pages we tried, so we did not open the standard's own page. The process below comes from search results that point to a Cloud Security Alliance article, certification-body notes and consultancy guides; these are secondary and differ in detail. We found no reliable fee schedule, so we give no rupee figures. Ask accredited certification bodies for quotes.
What the standard is
ISO/IEC 42001 sets requirements for establishing, running and improving an AI management system (AIMS). Think of it as the AI counterpart to ISO 27001 for information security: a system of management, not a technical test of any model. It applies to organisations that build, provide or use AI.
It is certifiable, which sets it apart from voluntary guidance such as the NIST AI RMF.
Why Indian companies pursue it
- Customers, especially global ones, ask for evidence of AI governance in vendor questionnaires.
- It gives a structure when the EU AI Act or other rules may apply. See EU AI Act: what Indian companies should know.
- It turns scattered AI policies into one managed system.
Certification does not prove your AI is accurate. It shows you have a managed system to control risk.
The process, step by step
| Step | What happens | Typical output |
|---|---|---|
| 1. Scope | Decide which AI systems, units and locations are in | Written scope statement |
| 2. Gap analysis | Compare current practice to the standard | Gap list and plan |
| 3. Build the system | Policy, roles, risk and impact assessment, controls, training | Documented AIMS |
| 4. Internal audit | Check the system yourself, with management review | Audit report |
| 5. Stage 1 | Certification body reviews documents and readiness | Readiness findings |
| 6. Stage 2 | Auditors test whether it works in practice | Findings, then certificate |
| 7. Surveillance | Periodic audits to confirm it still works | Maintained certificate |
Sources we read describe Stage 1 as a documentation review that can take one to two days, and a certificate valid for three years with annual surveillance and a recertification audit. They differ on some detail. Confirm with your chosen body.
The internal audit is not optional
One guide we read says an internal audit is a mandatory requirement and should be done before Stage 1. If your firm audits AI management systems, see our ISO 42001 internal audit checklist.
What drives cost
We will not quote numbers we cannot source. These are the factors that move the bill.
- Scope. One product or the whole organisation.
- Number of AI systems and use cases. More systems mean more risk and impact assessments.
- Size and sites. Headcount and locations affect audit time.
- Existing maturity. Companies with ISO 27001 or strong governance start ahead.
- Documentation gaps. The more you must write from scratch, the more internal effort or consultant time.
- Tooling. Logging, monitoring and inventory systems.
- Certification body. Fees and audit-day calculations vary, so compare quotes.
- Internal time. Staff hours are often the largest hidden cost.
- Ongoing work. Surveillance audits, reviews and training recur each year.
A readiness checklist
- Executive sponsor named
- AI inventory complete
- Scope statement approved
- AI policy issued
- Risk and impact assessment method defined
- Roles and responsibilities assigned
- Supplier and data controls reviewed
- Staff trained
- Internal audit done and findings closed
- Management review held
Our AI governance framework post covers items 2 to 6 in a lighter form, and the AI governance workpaper helps document them.
Choosing a certification body
Look for an accredited body. Ask which accreditation covers ISO/IEC 42001, how audit days are calculated, and whether they have audited organisations like yours. Accreditation details were not something we could verify here, so check them directly.
Frequently Asked Questions
Is ISO 42001 mandatory in India?
We found no Indian law requiring it. It is voluntary, though customers may ask for it.
How long does certification take?
It depends on your starting point and scope. Sources we read give no single answer, so plan with your certification body.
How much does ISO 42001 certification cost?
We could not verify a reliable figure, so we do not give one. Costs depend on the drivers above. Request written quotes.
What is the difference between Stage 1 and Stage 2?
Stage 1 reviews your documents and readiness. Stage 2 tests whether the system works in practice.
Does ISO 42001 replace the NIST AI RMF?
No. They serve different purposes. ISO 42001 is certifiable; the NIST framework is voluntary guidance. Many organisations use both.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error