ISO 42001 certification body: how to choose one

How to choose an ISO 42001 certification body in practice

A customer questionnaire or contract clause asking for ISO/IEC 42001 certification usually means one thing: someone outside your organization needs to see an independent certificate. Only an independent certification body issues that certificate. ISO does not certify organizations, and accreditation of certification bodies is voluntary. Before you shortlist anyone, ask the customer exactly what proof they accept, because some buyers want an accredited certificate and others will accept a certificate from any body they recognize. Getting that answer first narrows the field and avoids paying for a certificate your customer will not read.

Once the accepted proof is clear, check three things about each candidate. First, its accreditation status: confirm which accreditation body granted it, that the accreditation covers ISO/IEC 42001 certification, and that the body uses ISO/IEC 17021-1 as its base requirement. Second, its experience with AI management systems: ask how many AI management system audits it has run, who the auditors are, and how it qualifies people to audit against ISO/IEC 42006, which adds requirements for certifying AI management systems. Third, its scope rules: ask how it plans audit time and whether it will assess your AI use, not only your documentation. Ask for these answers in writing, because they drive the quote far more than the headline fee does.

Verify the certificate yourself before relying on it. Ask the body for its accreditation number, then search the certificate in IAF CertSearch, which ISO describes as combining accreditation and certification data. Note that ISO/IEC 42001 is not yet listed as an endorsed sub-scope under the Global ACI recognition arrangement, so confirm with the accreditation body whether its accreditation for AI management systems is in place rather than assuming it from the certificate's appearance. Keep a copy of the accreditation scope and the certificate's status date in your third-party records, and check status again at each surveillance audit.

What ISO/IEC 42006 asks of bodies that certify AI management systems

ISO/IEC 42006:2025 sets the competence rules that certification bodies must meet before they audit an AI management system against ISO/IEC 42001. The four points below explain how that standard connects to general certification body rules, who it is written for, and what a buyer should check when comparing certifiers.

A supplement to ISO/IEC 17021-1

ISO/IEC 42006 does not stand alone. It adds requirements on top of ISO/IEC 17021-1, the general standard for bodies that certify management systems, so a certifier must meet both. Ask a candidate body to show how its general management system certification processes apply to AI audits, and confirm that its AI-specific competence rules come from the supplement as well as the base standard.

Written for certifiers and accreditors

The standard is aimed at certification bodies that audit AI management systems and at the accreditation bodies that assess those certifiers. It is not a guide for organizations seeking certification. Buyers should therefore expect a certifier to describe its own accreditation scope and assessor competence, and should treat a vague answer about how the body meets these requirements as a reason to ask further questions.

Use in ISO/IEC 17065 schemes

ISO's FAQ notes that the same requirements can be built into product, process or service certification schemes operated under ISO/IEC 17065. A body offering an AI-related product or service certificate may therefore use similar competence rules under a different standard. When a certificate is described as covering AI, confirm which standard the body is accredited against and whether the claim is a management system certificate under ISO/IEC 42001.

Checking auditor competence

For buyers, the practical question is whether the certifier can show competent auditors for AI management systems. Ask for the accreditation scope that names ISO/IEC 42001, the auditor qualifications the body uses for AI audits, and how it handles technical expertise in AI system development and operation. Compare at least two bodies, and check the accreditation status of each before signing an audit contract.

Accredited or unaccredited: which certificate do you need?

This table compares a certificate from an accredited certification body with one from a body that holds no accreditation. Read each row as a question to put to a prospective certifier, and note that ISO treats accreditation as voluntary, so the choice depends on what your customers and contracts will accept.

Aspect	Accredited certificate	Unaccredited certificate
What it proves	The certification body was assessed by an accreditation body against ISO/IEC 17021-1 and the AI-specific requirements of ISO/IEC 42006, and the audit was checked under that oversight.	The issuer says it audited the AI management system against ISO/IEC 42001. No independent body has checked the issuer's competence or impartiality.
How to check it	Confirm the accreditation body is a Global ACI member, then search the certificate in IAF CertSearch and confirm the scope names ISO/IEC 42001.	Ask for the issuer's accreditation status in writing. If none exists, there is no accreditation register entry to search, so rely on the contract and the certifier's own documents.
What it means for customers	Procurement teams can usually accept it as independent assurance without further review of the certifier.	Customers may need to review the audit report, the certifier's competence and the scope themselves, which can lengthen due diligence.
What it means for regulators	Regulators can see that the certificate came from an accredited process, but no law makes an accredited ISO/IEC 42001 certificate mandatory.	Regulators will not treat it as accredited assurance. Any reliance on it should be supported by the organization's own evidence.
Scope of ISO/IEC 42001 recognition	ISO/IEC 42001 is not listed as an endorsed sub-scope of the Global ACI recognition arrangement as of Global ACI-FMRA-001 version 3.3, so confirm the accreditation scope explicitly names AI management systems.	No recognition arrangement applies. Ask the certifier which accreditation or standards body, if any, has assessed its work.
Who sets the requirement	ISO states accreditation is voluntary. The customer contract should name the accepted assurance level and the accreditation body it expects.	The organization accepts the risk that a customer or auditor later rejects the certificate as insufficient.
When it fits	Customers, procurement or tenders ask for independent, accredited assurance, or the organization wants a certificate that holds up to scrutiny.	A voluntary internal benchmark or early-stage readiness work where no customer requires accredited assurance and the contract accepts an unaccredited result.
Questions to ask the certifier	Which accreditation body accredited you, what is the accredited scope, and does the certificate appear in IAF CertSearch?	What standard and competence evidence do you hold, how are auditors selected, and will you accept a future accreditation review?

Where AI management systems sit in Global ACI recognition

Before you rely on any ISO/IEC 42001 certificate, understand where AI management systems sit in the accreditation system behind it. The International Accreditation Forum ceased operations on 1 January 2026. Its role, and that of ILAC, passed to Global Accreditation Cooperation Incorporated (Global ACI), which now runs the Global ACI Multilateral Recognition Arrangement (MRA). Accreditation bodies that once worked under the IAF framework now sit under Global ACI's rules, so the recognition chain you check is different from the one many older guides describe.

Global ACI-MRA-001 version 2.0 places certification of management systems in the MRA main scope, with ISO/IEC 17021-1 as the level 3 normative document that accreditation bodies use to assess certification bodies. That places management system certification in general within the arrangement. It does not, by itself, confirm that a given AI management system scope is recognized. Global ACI-FMRA-001 version 3.3 lists endorsed management system sub-scopes, such as ISO/IEC 27001:2022 with ISO/IEC 27006-1:2024, but it lists no entry for ISO/IEC 42001 or ISO/IEC 42006 at the version we reviewed.

Treat this gap as a due diligence step, not a disqualifier. Ask each certification body, in writing, which accreditation body accredits it, whether that accreditation explicitly covers ISO/IEC 42001 and ISO/IEC 42006, and for the scope reference number. Then confirm the answer with the accreditation body directly and review the current Global ACI documents yourself, since these lists change between versions. If the answer is that the scope is not yet covered, decide with your procurement and legal teams whether an unaccredited certificate is acceptable for the customer or regulator asking for it.

How to verify an ISO 42001 certificate before you rely on it

This sequence confirms that a certificate is current, issued by a body whose accreditation status you can check, and scoped to the AI systems your contract covers. It ends with a dated record you can show procurement, legal and your own assessors.

Request the certificate and its scope statement
Ask the supplier, in writing, for a copy of the ISO/IEC 42001 certificate and the scope statement that accompanies it. The scope statement describes which products, services, AI systems and business units the certificate covers, and it is the document that determines what you can rely on. Ask for the certificate number, the issue and expiry dates, and the name of the certification body that issued it. Keep the request and the supplier's response on file with the contract records. The output is a copy of the certificate and scope statement stored with the supplier file, along with the certificate number you will search for in the next step.
Search IAF CertSearch for certificate status
Search IAF CertSearch using the certificate number and the certification body's name. ISO notes that the database combines accreditation and certification data and can verify a certificate's status one record at a time, in bulk or through an API. Check whether the certificate is listed as valid, suspended, withdrawn or expired, and compare the details with the copy the supplier sent. If the certificate does not appear, do not treat that as proof of fraud on its own; ask the supplier and the certification body to explain. The output is a screenshot or exported record showing the certificate status and the date you checked it.
Check the issuing body's accreditation data
In the same search results, review the accreditation data for the certification body. Confirm that the body is accredited for the management system certification it is issuing, and identify the accreditation body that granted it. Note that accreditation is voluntary, so a body may certify AI management systems without accreditation, and that situation changes how much weight you place on its certificate. Global ACI-FMRA-001 version 3.3 does not list ISO/IEC 42001 as an endorsed sub-scope of the Global ACI recognition arrangement, so ask the certification body and its accreditation body directly which scope applies to the AI management system certificate. The output is a written note recording the accreditation body, the accredited scope and any gap between that scope and the certificate you hold.
Match the certificate scope to your contract
Compare the scope statement against the AI systems, products and business units named in your contract or statement of work. Confirm that the certified organization, sites and AI systems match what the supplier will deliver to you. Look for exclusions, such as a system that is out of scope, a product line that is not covered or a subsidiary that is not part of the certified entity. Ask the supplier to explain any mismatch in writing before you rely on the certificate. The output is a scope comparison table that lists each contracted AI system and whether it is inside or outside the certificate scope.
Confirm the body name and accreditation symbol
Check the certificate itself for the certification body's legal name, its address and any accreditation symbol or mark. Compare these with the entries in the database search. Global ACI-MRA-006, implemented on 1 January 2026, governs how accreditation bodies and certification bodies may use the MRA mark and claim accreditation status, so an accreditation mark should match a verifiable accreditation record. If the name, address or mark differs from what the database shows, stop and ask for an explanation from the certification body. The output is a confirmation note recording that the name, address and mark match, or the discrepancy and how it was resolved.
Assess the risk of a counterfeit certificate
Global ACI-TECH-3-015 (I), issued 10 July 2026, is informative guidance on the risk policy for counterfeit certificates. Use it to shape your own checks: treat a certificate that you received only as a PDF from the supplier, with no database match, as unverified. Consider whether a certificate that is outside its validity period, lacks a scope statement or names a body you cannot find in the database needs escalation. Record the risk level you assigned and the reason. The output is a short risk note that states whether the certificate is verified, unverified or escalated, and who approved that decision.
Record the check date and set a recheck point
Record the date you completed the verification, the person who performed it, the database search reference and the outcome. Certificate status can change after issue, so set a recheck point in your supplier review calendar and repeat the status search at that point, and before any renewal of the contract. Keep this record with the contract file so that auditors, customers or regulators can see when the check was performed. The output is a verification record containing the check date, reviewer, search reference, scope result and next recheck date, filed with the supplier's contract documents.

Checks to run before you sign with a certification body

ISO does not certify organizations, so the certificate you receive is only as credible as the body that issued it. ISO advises comparing several certification bodies and checking their accreditation, and the six checks below give you written evidence to compare them on.

Accreditation status for the AI scope

Ask whether the body holds accreditation that explicitly covers ISO/IEC 42001, not just management system certification in general. Accreditation is voluntary, and the Global ACI MRA scope does not currently list ISO/IEC 42001 as an endorsed sub-scope, so a body may be accredited for other standards only. Request the accreditation certificate and its scope schedule, then confirm the AI standard appears on it with the accreditation body's name and the validity dates.

Use of ISO/IEC 42006 with ISO/IEC 17021-1

ISO/IEC 42006:2025 adds requirements on top of ISO/IEC 17021-1 for bodies auditing AI management systems, so a body certifying against ISO/IEC 42001 should be able to show how it meets both. Ask for its written procedures that map its audit process to each standard, and ask how it has trained staff on the additional requirements. A body that cites only the general certification standard for AI work is a warning sign.

CASCO standards the body applies

Confirm which conformity assessment standards the body operates under for this scope, since ISO points buyers to checking the CASCO standard in use. For certification of management systems, expect ISO/IEC 17021-1 as the base requirement. Ask the body to name every standard in its management system and its accreditation scope document, and ask for the version numbers so you can check them against the current editions.

Auditor competence in AI management systems

Ask for the competence criteria the body uses to qualify auditors for AI management systems, including their understanding of the Annex A controls and of AI risk and impact assessment. Request anonymized records showing which auditors are approved for the AI scope, their technical background and their recent relevant experience. Confirm that auditors on your audit team are not drawn from a pool that has never audited this scope.

Independence from your consultant

If an implementation partner helped you build the AI management system, the certification body cannot also design or prepare it for you without compromising its impartiality. Ask the body in writing whether it offers consulting, and whether it has ever provided advice on systems it later audited. Ask your consultant to confirm it has no ownership or commercial tie to the body. The consultant prepares your evidence; only the body issues the certificate.

Nonconformity and certificate decision process

Request the body's written process for raising nonconformities, setting corrective action deadlines, escalating disputes and making certification decisions. Ask who makes the decision and whether it is separate from the auditors who conducted the audit. Also ask how the body suspends or withdraws a certificate, and how it publishes that status so customers can see it. A clear written process is the best evidence the body will apply the same standard to every client.

Who owns the controls, who prepares evidence, and who certifies

Your organization is the only party that can own the AI management system. It decides the scope, sets the AI policy, accepts the residual risks of each AI system, and is accountable to customers, regulators and the certification body for what the controls actually do. Those decisions cannot be delegated to a consultant or a partner, even when outside help does much of the preparation work.

Scope and policy decisions: Define which AI systems, products and business units fall inside the AI management system, and approve the AI policy and its objectives.
Statement of applicability: Decide which Annex A controls are necessary, justify each inclusion or exclusion under clause 6.1.3, and sign off the document.
Control ownership: Name an accountable owner for each control, such as the person responsible for impact assessments or for supplier oversight, who runs the control day to day.
Management review and governance: Hold the management review, approve AI risk acceptance and resolve nonconformities raised by internal audit or the certifier.
Commonly outsourced: Gap analysis, documentation drafting support, internal audit preparation and tooling, provided the owners still review and adopt the output.

Before you engage anyone, confirm internally who will own AI governance after the project ends, because an outside team cannot run your management reviews indefinitely.

What delays certification body selection and how to avoid it

Most delays in choosing a certification body come from decisions made before the first call: the assurance level the customer will accept, the scope of the certificate, and the terms of the audit. The cards below cover six pitfalls that cost time or money, each paired with the check that prevents it.

Choosing a body before confirming assurance level

Many organizations pick a certification body first and only later learn that the customer or contract wants an accredited certificate, or accepts a self-declared one. Switching bodies after a contract is signed can mean restarting the engagement and renegotiating the audit plan. Before shortlisting, ask the customer in writing which assurance level it accepts and whether it names specific accreditation bodies. Record the answer in the scoping document so every candidate quotes against the same requirement.

Assuming ISO 27001 accreditation covers ISO 42001

A certification body accredited for ISO/IEC 27001 has not thereby been shown competent to certify AI management systems. ISO/IEC 42006 adds requirements for bodies auditing AI management systems on top of ISO/IEC 17021-1, and ISO/IEC 42001 is not listed as an endorsed sub-scope in the Global ACI arrangement. Ask each body for the accreditation scope document that names ISO/IEC 42001 explicitly, and confirm the accreditation body's own assessment covers it.

Skipping certificate verification

Counterfeit or misrepresented certificates are a known risk, and a certificate shown in a procurement pack may not reflect what the body actually issued. Verification should happen against the registry of the accreditation and certification data, not against a PDF supplied by the vendor or the auditor. Check the issuing body name, certificate number, scope statement, validity dates and accreditation mark, and repeat the check before contract signature and at each surveillance audit.

Scoping the certificate too narrowly or broadly

A certificate scope that excludes the AI systems a customer actually relies on will fail the questionnaire, while a scope that claims everything invites scrutiny the organization cannot sustain. Illustratively, a SaaS provider that certifies its core product but leaves out a newly launched AI feature may be asked to justify the gap during due diligence. Agree the AI systems, products, sites and business units in writing, and confirm that the statement of applicability supports the same boundary.

Hiring a consultant who also audits

A consultant who designed the AI management system and then certifies it cannot give an independent opinion on it. Certification bodies must maintain impartiality, and the same firm or person acting as both adviser and auditor can force a body to refuse the engagement or reissue the report. Ask each candidate body to confirm it has not provided implementation services for the same management system, and keep preparation work with a separate party.

Signing a quote without a written audit scope

Quotes that give a single day rate without naming the sites, AI systems, standards clauses and Annex A controls to be audited tend to grow during stage 1 when the auditor asks for more evidence. Ask each body for a quote built from a written audit plan that lists the audit days by stage, the sites and the scope boundary. Also confirm who pays for additional days if the scope changes, and how surveillance and recertification fees are set.

Questions buyers ask about ISO 42001 certification bodies

Does ISO certify organizations to ISO 42001?

No. ISO does not certify organizations. External certification bodies issue ISO/IEC 42001 certificates after auditing the organization's AI management system. ISO's own guidance is to compare several certification bodies, confirm that each body works to the relevant CASCO standard, and check its accreditation status. The organization owns its AI management system and its controls. The certification body only audits them and decides whether to certify. Ask each body which standards it certifies to and whether its ISO/IEC 42001 work is covered by an accreditation.

Is accreditation required for an ISO 42001 certificate?

No. ISO states that accreditation of certification bodies is voluntary, so a certificate can be issued by a body that is not accredited. The practical difference is what a customer or regulator can rely on. An accredited certificate shows that an independent accreditation body has assessed the certifier against its requirements. An unaccredited certificate may still be valid, but its weight depends on who is asking. Before signing, ask the body whether its ISO/IEC 42001 certificates are accredited, which accreditation body granted it, and whether the buyer's contract names an accreditation requirement.

Does an ISO 27001 accreditation cover ISO 42001 certification?

Not automatically. An accreditation covers only the scopes that the accreditation body has listed for the certification body. The Global ACI recognition arrangement lists ISO/IEC 27001:2022 with ISO/IEC 27006-1:2024 as an endorsed management system sub-scope, but the Global ACI-FMRA-001 document (version 3.3) lists no entry for ISO/IEC 42001 or ISO/IEC 42006. A body that holds an ISO 27001 accreditation may still lack accreditation for AI management systems. Ask the body for the exact accredited scope in writing and confirm it on the accreditation body's directory before relying on it.

What does ISO/IEC 42006 change for AI management system auditors?

ISO/IEC 42006:2025, published on 7 July 2025, sets requirements for bodies that audit and certify AI management systems. It supplements ISO/IEC 17021-1 rather than replacing it, so a certifier still needs the general management system certification requirements plus the AI-specific ones. ISO says it is intended for certification bodies auditing against ISO/IEC 42001 and for the accreditation bodies that assess them. For buyers, this means you should ask whether the auditors are competent in AI systems, how the body handles AI-specific audit topics, and whether its procedures follow ISO/IEC 42006. Confirm these points in the proposal.

How do I verify an ISO 42001 certificate is genuine and current?

Check the certificate against the issuing body's records and against an independent register. ISO says IAF CertSearch combines accreditation and certification data and can verify a certificate's status one at a time, in bulk or through an API. Global ACI links to it for certificate verification, and the International Accreditation Forum's role has passed to Global ACI since 1 January 2026. Confirm the certified organization's name, the certificate scope, the issue and expiry dates, and whether the scope includes the AI systems you care about. Also ask the body to confirm the certificate directly, because counterfeit certificates exist.

Can our ISO 42001 consultant also be the certification body?

No, the consultant and the certification body should be separate organizations. A certification body must be independent of the organization it certifies, and a firm that designed or ran the AI management system has a conflict of interest when it then audits that same system. Auditors who helped build the system cannot objectively test its weaknesses. Organizations may still use one firm for readiness work and another for certification, and the same principle applies in reverse for implementation partners. Ask any body you shortlist how it handles independence, and ask any consultant which bodies it works with and whether it has ever audited a client it advised.

What must our organization provide before a certification body quotes?

A certification body needs a written scope before it can quote. Prepare the organization's name and sites, the AI systems and products inside the scope, the people and roles who run them, the current AI policy and risk or impact assessment records, and any existing ISO 27001 certificate if you plan an integrated audit. Include the number of employees, the locations, and whether any key processes are outsourced to suppliers. Ask the body to list what its quote covers: stage 1 and stage 2 audits, surveillance audits, recertification, travel and any accreditation-related fees. Confirm each item in writing before you compare bodies.

How DeployOpen prepares your team for the certification body

DeployOpen does not select or certify bodies on your behalf. We help your team prepare the systems, controls and evidence that a certification body will examine, so you can compare bodies on the same ground. Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we scope

The written scope names which AI systems, teams and sites fall inside the AI management system under review.
We confirm which certification body and accreditation status you are evaluating, so preparation matches its requirements.
The scope also states which Annex A controls are in the statement of applicability and what each exclusion is justified by.

How we build

We set up documented AI policy, roles and records so an external auditor can trace each claim to evidence.
We prepare verification steps for the certificate status check, so your team can confirm a certificate on IAF CertSearch.
We test internal processes against the questions a certification body is likely to ask, and document the gaps found.

How we hand over

You receive the documentation, configuration records and evidence index, with owners named for each item.
Your staff are trained to walk an auditor through the evidence, and to explain why the certification body was chosen.
We confirm that all ownership of AI governance decisions and certification contracts stays with your organization.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the handover is complete.
A retainer can cover updates to evidence when the AI system changes or when a certification body requests new records.
Any support scope, including surveillance audit preparation, is agreed in writing before it begins.

Choosing an ISO 42001 certification body