Questions organizations ask when a customer, contract or regulator points them to ISO/IEC 42001: cost, the certification process, choosing a certification body, impact assessment, combining it with ISO 27001, and how it relates to the EU AI Act and the NIST AI RMF.
What ISO/IEC 42001 certification costs and why it varies: buying the standard and companion documents, certification body audit fees across the three-year cycle, how audit time is set, savings from an integrated audit with ISO 27001, and internal effort and tooling.
How ISO/IEC 42001 certification works end to end: scoping the AI management system, the statement of applicability, internal audit and management review, the stage 1 and stage 2 audits, surveillance and recertification over three years, and verifying the certificate.
How to choose and check an ISO/IEC 42001 certification body: what ISO/IEC 42006 requires of certifiers, accredited versus unaccredited certificates, where AI management systems sit in the Global ACI recognition arrangement, and how to verify a certificate.
How AI system impact assessment works under ISO/IEC 42001: clauses 6.1.4 and 8.4, the four A.5 controls, guidance in ISO/IEC 42005:2025, how it differs from AI risk assessment, and how it relates to the EU AI Act fundamental rights impact assessment.
Running ISO/IEC 42001 alongside ISO/IEC 27001: the shared harmonized structure, how the two Annex A control sets differ, separate certification body rules (ISO/IEC 42006 and ISO/IEC 27006-1), and how integrated audits are planned and priced.
How voluntary ISO/IEC 42001 certification relates to the binding EU AI Act: application dates after the Digital Omnibus, the Article 17 quality management system, presumption of conformity from harmonised standards, EN 18286, and the Commission's view of ISO/IEC 42001.
How the certifiable ISO/IEC 42001 management system compares with the voluntary NIST AI Risk Management Framework: structure, status and revisions, the crosswalk NIST hosts between them, and how organizations use both.
Whether any law requires ISO 42001 and who ends up needing it: voluntary certification, customer and procurement demands, why it does not by itself meet the EU AI Act quality management system, and where it helps with AI Act and NIST AI RMF expectations.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.