ISO 27001 for AI companies: does your AI business need it?

Does an AI company need ISO 27001 or ISO 42001?

Most AI companies start with ISO/IEC 27001:2022, the information security management standard published in October 2022, and add ISO/IEC 42001:2023, the AI management system standard published in December 2023, when a customer or tender asks for AI governance. The first question is therefore what the request actually names: an information security certificate, an AI management certificate, or both. Read the wording of the customer's questionnaire, security schedule or tender closely, because a request for "responsible AI" evidence and a request for an ISMS certificate lead to different scopes and different audits.

The answer depends on three things: what the customer requires, which AI systems and products fall inside the scope, and which certificates the company already holds or its cloud and model providers hold. A company whose AI service runs entirely on a certified cloud platform may inherit part of its infrastructure evidence, but it still has to show its own access controls, development practices and data handling. Ask each customer for the exact standard and edition, the certificate scope they expect, and whether they accept a certificate issued by an accredited certification body. Confirm these points before committing to a scope, because the scope drives audit time and cost.

The organization owns its controls and its Statement of Applicability. A partner can prepare the ISMS, the AI management system, the evidence and the internal audit, but only an accredited certification body issues the certificate after an independent audit. Check the accreditation of any body you shortlist, and treat a document that calls itself a certification from a consultant or tool vendor as a claim to verify, not as evidence.

What certifying both standards costs and who is paid

This table lists each cost component of certifying to ISO/IEC 27001 and ISO/IEC 42001, who is paid for it, whether it is one-time or recurring, and what moves it up or down. Use it to build a quote request, since the standard purchase prices are only a small part of the total. The main takeaway is that certification body fees, staff time and surveillance audits recur across the cycle, so ask each provider for the multi-year figure.

Cost component	Who is paid or who bears it	One-time or recurring, and what drives it
Standard purchase	ISO (ISO/IEC 27001:2022 at CHF 155, ISO/IEC 42001:2023 at CHF 225, per ISO pricing)	One-time per standard. Buying the text does not give certification; confirm which edition each provider audits against.
Accredited certification body, ISO/IEC 27001	Accredited certification body (not ISO)	Initial certification and later audits. Driven by scope, number of sites, headcount and in-scope AI systems. Request a written quote.
Accredited certification body, ISO/IEC 42001	Accredited certification body (not ISO)	Initial certification and later audits. Driven by the AI systems in scope and whether the body applies ISO/IEC 42006:2025. Request a written quote.
Integrated audit time	Certification body	Ask how audit time is calculated for each standard, then combined. Global ACI-TECH-3-008 (M) allows a reduction of no more than 20% from the summed time, so confirm the reduction used in the quote.
Internal staff time	Your own payroll (engineering, security, legal, product and data teams)	Recurring. Driven by how many AI model owners, data pipelines and suppliers must produce evidence each year, not just the initial build.
Implementation partner fees	Outside consultant or implementer, if used	Mostly one-time for the build, plus any retainer. Driven by scope and by how much of the ISMS and AIMS you hand over. The partner prepares evidence, but the organization owns the controls.
Tooling and cloud evidence	GRC or logging vendors, open-source hosting costs, and cloud providers	Recurring. Driven by log volume, model evaluation infrastructure and the number of evidence sources. AWS and similar providers' certificates can reduce the scope you audit yourself, but confirm the shared responsibility split.
Surveillance and recertification audits	Certification body	Recurring across the three-year cycle, with at least one audit every calendar year under ISO/IEC 17021-1. Driven by changes in scope, new AI systems and the findings from earlier audits.

What makes an AI company's certification cost more or take longer

Cost and duration for ISO 27001 at an AI company follow from a few decisions made before the audit starts: how much of the AI estate sits inside the ISMS, how many sites and accounts are covered, how mature the existing evidence is, and whether customers want one certificate or two. Each driver below can be shaped in advance, and most of them are easier to control at scoping than during the audit.

Number of AI systems in scope

Each production model, model endpoint, fine-tuned variant and internal agent that touches customer or company data adds controls to test, assets to inventory and risks to assess. Count them before scoping, and decide which ones sit inside the ISMS boundary and which sit outside with a documented reason. Ask the certification body how it samples systems during the audit and whether a larger inventory changes its audit days. Keep the register current, because an auditor who finds an unlisted model will widen the sample.

Training data pipelines in scope

Whether training data pipelines fall inside the ISMS determines how much access control, change control, data classification and logging evidence the auditor will request. Pipelines that pull customer data, label data through contractors or store datasets in shared buckets usually need full coverage. Decide the boundary explicitly and record it in the Statement of Applicability. Narrowing the boundary can reduce sampling, but it must be defensible against what the organization actually does with data.

Third-party model APIs and providers

Hosted model APIs, embedding services and labeling vendors are suppliers whose controls the organization must manage under the supplier controls in Annex A. The question to settle is whether each provider is in scope as a supplier only or whether its services form part of the delivered system. Collect each provider's own certificates or reports, record contract terms for data use and retention, and confirm what the provider's certificate covers. Gaps in supplier evidence are a common source of extra audit findings.

Sites and cloud accounts

Every additional site, office, cloud account, region or GPU cluster adds locations to sample and access reviews to perform. Consolidating accounts under a landing zone with central logging usually reduces the evidence effort, and it makes multi-site sampling simpler for the auditor. Confirm with the certification body how it treats multiple sites and whether remote or cloud-hosted infrastructure can be audited through the provider's certificates and the organization's own configuration evidence.

Existing evidence maturity

Auditors test whether controls operate over time, not whether a policy exists. Teams that already produce access reviews, change tickets, vulnerability scan results and incident records from their tooling will need less preparation than teams that assemble evidence by hand before each audit. Run a gap check against the Annex A controls, identify where evidence is missing or inconsistent, and decide whether to automate collection. Ask any implementation partner to show how each control's evidence is generated, stored and retained.

Certificate scope and integrated audit time

Customers that require both ISO 27001 and ISO/IEC 42001 can ask for an integrated audit. Under Global ACI-TECH-3-008 (M), the certification body calculates audit time for each standard separately, adds the two figures, and then may reduce the total by no more than 20%. Ask for the per-standard calculation in writing, check which reduction the body applies, and confirm the audit days before committing to a combined scope. A combined audit can save time, but it is not automatically cheaper than two separate audits, so compare quotes on the same scope.

ISO 27001 only, ISO 42001 only, or both

This option fits when a customer, bank or procurement team asks for information security certification and does not ask about AI governance. An ISO/IEC 27001:2022 certificate shows that an independent certification body found the organization's information security management system (ISMS) conforms to the standard's requirements in clauses 4 to 10 and that the controls selected in the Statement of Applicability are in place within the certified scope. Certification bodies for this standard apply ISO/IEC 27006-1:2024 on top of ISO/IEC 17021-1, and the certificate cycle runs three years with at least one audit every calendar year.

What the certificate proves: a documented ISMS covering the stated scope, with risk treatment tied to Annex A controls across the four themes.
Certification body rules: ISO/IEC 27006-1:2024 plus ISO/IEC 17021-1, which IAF MD 29:2024 required accredited bodies to apply by 31 March 2026.
Where AI sits: AI systems inside the ISMS scope are covered by information security controls, but the certificate does not assess AI-specific governance such as impact assessment or responsible use.
Cost drivers: the number of sites, the size of the scope and the number of AI services in it, all of which drive audit days.
Check before buying: confirm with the customer that the request names ISO/IEC 27001 and not an AI standard.

Ask the customer to name the exact standard and clause they need, and confirm the certificate scope covers the product and hosting environment the customer will use.

How an integrated ISO 27001 and ISO 42001 audit runs

The sequence moves from defining one shared scope to a certificate issued by an accredited certification body, with each phase producing a document or record that the next phase relies on. The organization owns every step, the implementation partner prepares the evidence, and only the certification body decides whether the management systems conform.

Define the shared scope and run the gap assessment
The organization sets the boundary of its information security management system and its AI management system, naming the products, AI systems, data flows, sites and cloud accounts that fall inside. An implementation partner or internal team then compares current practice against the clauses of ISO/IEC 27001:2022 and ISO/IEC 42001:2023 and the Annex A controls of each. The step is complete when the scope statement is approved by management and the gap list has an owner and a due date for each item. Ask the certification body early whether it will audit both standards in one integrated engagement, because that decision shapes the scope wording.
Build the Statement of Applicability and AI system inventory
The organization writes a Statement of Applicability for ISO/IEC 27001 that states which of the 93 Annex A controls apply, which do not, and why. In parallel it creates an inventory of AI systems in scope, recording each system's purpose, provider or deployer role, training and input data sources, and the Annex A AI controls of ISO/IEC 42001 that apply to it. The two records must agree on shared topics such as access control, supplier management and logging. The step is done when both documents are signed off and every control decision points to a named owner and an evidence source.
Operate the controls and collect evidence
Control owners run the processes described in the policies, such as access reviews, change approvals, model evaluation records, impact assessments and supplier reviews. Self-hosted or cloud-native tooling can capture logs, tickets and configuration snapshots as the work happens, so that evidence accumulates instead of being assembled before the audit. The organization, not the implementation partner, performs and owns these activities. The step is complete when a sample of each control shows the process ran as written over a meaningful period of operation.
Complete the internal audit and management review
An internal auditor independent of the controls being tested checks the integrated system against both standards and records nonconformities, observations and opportunities for improvement. Management then holds a review that covers audit results, risk changes, AI system changes and performance against objectives, and records decisions and actions. The output is an internal audit report and minutes of management review. These records are what the certification body will read first, so their quality matters more than their volume.
Pass the stage 1 documentation review
The certification body reviews the documented information for both management systems, including the scope, policies, risk assessment, Statement of Applicability and AI system inventory, to decide whether the design is ready for an on-site or remote assessment. It identifies gaps that would block a stage 2 audit and records them for the organization to close. The certification body decides the stage 1 result, not the implementation partner. The step is complete when the auditor confirms readiness and the organization has a written list of items to address before stage 2.
Pass the stage 2 audit of implementation
The certification body tests whether the integrated management system works in practice, sampling control operation, interviewing staff and product teams, and examining AI system records against the Annex A controls of both standards. Audit time for the two standards is calculated under the integrated audit rules in Global ACI-TECH-3-008 (M), so the combined audit may be shorter than two separate audits but not by more than 20% of the sum of the separate times. Nonconformities are raised and must be corrected and verified before a certification decision. The step is complete when the certification body records its decision on both standards.
Receive the certificates and maintain the cycle
After a positive decision, the certification body issues certificates for the defined scope. Under ISO/IEC 17021-1, a certification cycle lasts three years with at least one audit, either surveillance or recertification, in every calendar year, as explained in European Accreditation FAQs 51.7 and 37.12. The organization keeps its management reviews, internal audits and evidence running between audits, because each surveillance visit tests the same systems again. Buyers can confirm current status in the IAF CertSearch database, which ISO still points to for checking accredited certificates.

Which cloud and AI provider certificates customers already rely on

Customers evaluating an AI company will often ask which of its cloud and AI providers hold certificates, because those providers run the infrastructure the AI company depends on. AWS holds ISO/IEC 27001:2022, ISO/IEC 27017:2015 and ISO/IEC 27018:2019 certifications, and according to AWS's ISO/IEC 27001 FAQs, EY CertifyPoint, an ISO certifying agent accredited by the Dutch Accreditation Council and an IAF member, verifies the ISO/IEC 27001:2022 certification. Use that as a starting point, not a conclusion: ask each provider for its current certificate, the exact scope it covers (regions, services and sites), and the expiry date, then check the certificate against the IAF CertSearch database that ISO points to. Confirm the scope yourself, because a provider can hold a certificate that covers some services and not others.

Inheriting a provider's certificate covers only the provider's infrastructure. It does not cover your company's information security management system, your risk assessment, your Statement of Applicability, or the controls you run over your own models, training data, prompts, customer data and staff access. An assessor will ask which controls the provider operates under its certificate and which controls you must still evidence yourself. Build a responsibility matrix that marks each Annex A control as provider-operated, shared or yours, and keep it current when you add a region or a managed AI service. Also check whether the AI provider you call through an API is inside that cloud certificate or sits under a separate contract and certificate of its own.

CSA's STAR for AI program adds an AI-specific layer that customers may ask about alongside ISO/IEC 27001. Level 1 is a self-assessment: an AI-CAIQ questionnaire built on the AI Controls Matrix. Since 20 November 2025, a validated AI-CAIQ combined with ISO/IEC 42001 certification achieves STAR for AI Level 2, according to the Cloud Security Alliance. For an AI company, this means the ISO/IEC 42001 certificate is what moves a STAR submission from self-assessment to a higher level, so confirm the current level requirements and validation route on the Cloud Security Alliance STAR page before you promise a level in a sales cycle.

What must be in place before an AI company goes to audit

A certification body will test whether your management system is defined, operating and provably so before it issues anything. The six items below are the ones that most often decide whether a first audit runs smoothly, and each can be checked internally before the auditor arrives.

Defined ISMS and AIMS scope

Write down which products, AI systems, environments, sites and teams each management system covers, and which it excludes with reasons. Model training pipelines, inference APIs, fine-tuning environments and customer-facing tooling often sit in different places, so the boundary must be explicit. Check it by asking whether an engineer could tell from the document if a given service is inside or outside the scope. If the answer is unclear, the scope is not ready.

Inventory of AI systems and data sources

Keep a register of every AI system in scope, its owner, the models it uses (in-house or third-party), the datasets it trains or runs on, and where each dataset came from. Missing entries are a common source of nonconformities because the risk assessment and the Statement of Applicability depend on this list. Check it by picking one production model and tracing its training and inference data back to a documented source and owner.

Risk assessment covering model and data risks

Run your information security risk assessment with model and data risks included, such as training data poisoning, prompt injection, model extraction, leakage of customer data through outputs, and unauthorized model changes. Record how each risk is scored, who accepted each residual risk and the treatment chosen. Check it by confirming that every risk treatment decision traces to a control, and that the risk owners named in the register still hold those roles.

Statement of Applicability for each standard

Prepare a Statement of Applicability for ISO/IEC 27001:2022 that lists all 93 Annex A controls, marks each as applicable or excluded, and gives the reason and the implementation status. If ISO/IEC 42001:2023 is also in scope, keep a separate statement for its 38 Annex A controls rather than mixing them. Check it by sampling five controls at random and confirming that the evidence named in the statement exists and is current.

Evidence from logging, access and change management

Auditors test whether controls work over time, so you need records, not only policies. Keep logs of administrative and model-access activity, reviews of who can reach training data and model weights, and tickets or pull requests showing that changes to models, prompts, datasets and infrastructure were reviewed and approved. Check it by choosing a recent model release and confirming you can produce its approval record, the access list at that date and the logs that cover the deployment window.

Supplier controls for model and cloud providers

List every external model provider, hosted inference service, data labeling vendor and cloud platform that touches in-scope data or systems. For each, record the contract terms on security and data use, the assurance evidence you hold, such as a current ISO/IEC 27001 certificate or a report from the provider, and the review date. Check it by confirming that each supplier on the list has a named owner and that you can produce its assurance evidence on request.

Who owns which part of the certification

The AI company is the only party that can make the decisions an ISMS is built on. It defines the scope of the management system, which products, models, training pipelines, data stores and customer environments are inside it. It runs the risk assessment and risk treatment, decides which controls apply, and writes the Statement of Applicability that justifies each inclusion and exclusion. Management also keeps the obligations that cannot be delegated: approving the policy, assigning roles and staffing the work.

Scope decisions: Define which AI products, model development environments, data pipelines and hosting accounts sit inside the ISMS, and document the boundary.
Risk decisions: Own the risk assessment method, the risk owners and the acceptance of residual risk.
Statement of Applicability: Decide which Annex A controls apply, record the reasons for each inclusion or exclusion and keep it current.
Governance: Approve the information security policy, assign roles and fund the internal audit and management review.
Day-to-day operation: Run access reviews, change approvals, incident handling and supplier management as recurring activities.

Before engaging anyone, confirm internally who will sign the scope and the Statement of Applicability, because a partner can draft these documents but cannot make the company's risk decisions for it.

How to choose a certification body and implementation partner

An ISO 27001 and ISO 42001 pursuit involves two different parties with two different jobs: a certification body that issues the certificates, and an implementation partner that prepares systems and evidence. Checking accreditation, standards applied, independence and written scope before signing protects both the certificate and the budget.

Confirm accreditation for both standards

Ask the certification body for its accreditation scope in writing and check it against the IAF CertSearch database, which ISO still points to for accredited certificates. Confirm that the body is accredited for ISO/IEC 27001 and for ISO/IEC 42001, since an AI company pursuing both needs both scopes covered. Since 1 January 2026, Global ACI has assumed the IAF and ILAC roles, so accreditation statements should reflect that structure.

Check the auditing standards applied

Ask which auditing rules the certifier follows. For ISO/IEC 27001 this is ISO/IEC 27006-1:2024 on top of ISO/IEC 17021-1, and for ISO/IEC 42001 it is ISO/IEC 42006:2025 on top of ISO/IEC 17021-1. A body that cannot name both standards for your scope may produce a certificate that later fails acceptance by customers or accreditation review.

Keep the implementer independent

The firm that designs your ISMS and AIMS and the firm that certifies it should be different organizations. An implementation partner prepares controls, documentation and evidence, while only the certification body decides conformity. Ask whether the implementer has any relationship with the certifier that could create a conflict, and get that answer in writing before work starts.

Get written scope and deliverables

Ask for a written scope that names the products, AI systems, sites, cloud accounts and business units in the ISMS and AI management system, plus a deliverables list with acceptance criteria. For an integrated audit, ask how the certifier will calculate audit time for each standard, since Global ACI-TECH-3-008 (M) limits any reduction to 20% of the summed time. Confirm who pays for re-audits caused by scope changes.

Test AI system experience

Ask both parties to show experience with AI systems in scope, including model inventories, training data provenance, impact assessments and monitoring of deployed models. Ask the certifier how it has audited AI-specific controls and what it expects as evidence for each Annex A control of ISO/IEC 42001. Request references only as named, verifiable contacts, not general claims.

Ask these questions before signing

Ask the certifier to confirm its accreditation scope, its audit plan for the three-year cycle with at least one audit each calendar year, and the cost components of the quote. Ask the implementer which tasks it owns, which stay with your staff, and how evidence is handed over. Ask both parties for their exit terms and how they will handle a nonconformity raised during the audit.

Questions AI companies ask before hiring outside help

Do we need both ISO 27001 and ISO 42001 certificates?

Not always, but most AI companies that sell to large customers end up weighing both. ISO/IEC 27001:2022 certifies an information security management system across the whole organization, with 93 Annex A controls in four themes. ISO/IEC 42001:2023 certifies an AI management system, with 38 Annex A controls in nine areas (A.2 to A.10) covering topics such as impact assessment, data provenance and responsible use. Customers that ask for information security assurance usually need 27001, while customers that ask how AI systems are governed usually need 42001. Confirm with your key customers and any regulator which certificate they name in contracts or questionnaires before you commit to scope.

What drives the cost of ISO 27001 for an AI company?

The cost has four parts: the certification body's audit fees, the time your staff spend preparing, any outside help you buy, and the tooling you run. Audit fees depend on the number of people in scope, sites, systems and the number of standards audited together, so ask each certification body for a quote built from a written scope. Internal time is often the largest hidden cost, because engineers must produce evidence from pipelines, access logs and change records. The main levers are a tight scope, reuse of cloud provider evidence for the hosting layer, and automated evidence collection. Ask every quote to show audit days per standard, surveillance audit costs for later years and any separate fees for a combined audit.

How long does the certification cycle run under ISO/IEC 17021-1?

Under ISO/IEC 17021-1, a management system certification cycle lasts three years. Within that cycle the certification body must audit the organization at least once in every calendar year, either as a surveillance audit or as the recertification audit. The first certification audit is therefore followed by surveillance audits in the following years, and a recertification audit at the end of the cycle. Plan your internal calendar around these fixed points, and confirm the audit dates and the specific plan with your chosen certification body, since the actual timing depends on their program and your readiness.

Can we run ISO 27001 ourselves without an outside consultant?

Yes, a team can run it internally, but the question is whether it has the time and independence to do so. The organization owns its controls, policies, risk assessment and Statement of Applicability, and none of that can be handed to an outside party. An implementation partner can prepare systems, configure tooling, produce evidence and document the ISMS, which frees your staff to decide and approve. Only an independent certification body issues the certificate. Keep the implementer and the certification body separate, because a firm that designed your controls should not be the one that audits them. Ask any partner to state exactly which tasks it performs and which remain with your staff.

What does the work need from our engineers?

Engineers do most of the evidence work, so plan for it early. Typical items include a list of production and model-training systems in scope, access reviews from identity providers, change records from CI/CD, logging and monitoring configuration, vulnerability scan results, backup and restore tests, and secure development practices for model code and data pipelines. Engineers also need to document how training data is sourced and how model releases are approved, because auditors ask for traceability. Infrastructure as code helps, since the configuration in version control can serve as evidence of how controls are set. Agree on named owners for each control before the audit starts.

Does our cloud provider's ISO 27001 certificate cover us?

No. A cloud provider certificate covers the provider's own information security management system for the services in its certificate scope, and it does not cover your organization's controls, people, products or model pipelines. AWS, for example, holds ISO/IEC 27001:2022, ISO/IEC 27017:2015 and ISO/IEC 27018:2019 certifications, and its FAQs point to EY CertifyPoint as the certifying agent that verifies the ISO/IEC 27001:2022 certification. Use the provider's certificate to support the hosting layer of your own scope, and check the scope statement carefully, since it lists specific services and regions. Your own controls for access, configuration and data handling still need evidence.

What changes when the certification body runs an integrated audit?

An integrated audit covers an integrated management system, such as ISO/IEC 42001 together with ISO/IEC 27001, in one audit engagement. It can reduce duplicate work, but it does not remove the separate requirements of each standard. Global ACI-TECH-3-008 (M), issued 10 July 2026, requires the certification body to calculate audit time for each standard separately, add those figures, and then adjust them, with any reduction not exceeding 20% of the sum. Ask the certification body to show the separate calculation in its quote. Also confirm that both standards are covered by the same accreditation and that the certificates will state their scope clearly.

How DeployOpen prepares an AI company for certification

DeployOpen starts with a written scope, because for an AI company the scope decides which systems, data flows and model-serving environments enter the ISMS and which sit outside it. The agreed scope lists the platforms DeployOpen will plan, implement and harden, the environments they run in, and the deliverables and timelines. Before any work starts, the company should confirm with its certification body how it wants the boundary drawn, especially if it plans to pursue ISO/IEC 42001 alongside ISO/IEC 27001 and needs a single integrated scope. Pricing follows that written scope, so the clearer the boundary, the more precise the quote.

Inside the client's own cloud accounts, data centers or air-gapped networks, DeployOpen implements and hardens self-hosted open-source platforms, such as the identity, logging, ticketing and secrets tooling that a small AI team typically needs. The work covers the controls the Statement of Applicability will claim, including access management, logging and monitoring, change control for model deployments and backup of training data and configuration. DeployOpen then prepares the evidence an auditor will sample: exported access reviews, log retention settings, infrastructure as code repositories, and records of risk treatment. Documentation is handed over so the company's own staff can operate and explain each control. DeployOpen does not issue audit reports, attestations or certificates. Only an independent certification body can do that, and the company owns its controls and its certification decision. Ongoing support, upgrades and continuous testing are available as a retainer, which suits AI companies whose model stack and cloud services change faster than a one-time project can track.

ISO 27001 for AI companies