What ISO 42001 certification cost depends on for your organization
If a customer, contract or regulator now asks for ISO/IEC 42001, the honest answer is that the cost is set by three things: the standard itself, the fees of the certification body that audits you, and the internal effort your team spends preparing. The purchase price of the standard is fixed and small. The certification body fees are not published by ISO, so you must request a quotation from each body. ISO sells ISO/IEC 42001:2023 for CHF 225 (the same price appears on the IEC Webstore), and ISO/IEC 42006:2025, which sets requirements for bodies that certify AI management systems, for CHF 159. ISO states that it does not certify organizations and that certification bodies set their own fees. Audit days come from each body's quotation, because the rules for setting audit time for AI management systems are not published in the supplied material. Ask each body to show how it calculated its days.
Plan the budget across the three-year certification cycle, not as a single audit invoice. Under ISO/IEC 17021-1, a certificate runs for three years, and at least one audit (surveillance or recertification) must occur in each calendar year of that cycle. Your quotation should therefore show the initial certification audit plus the annual surveillance audits and the recertification audit, with the fee for each. Scope drives the size of the audit: a narrow AI system with a small team costs less to assess than a platform with many AI products, suppliers and data sources. If you already hold ISO/IEC 27001, ask whether the certification body will run an integrated audit. Under the Global ACI rules, shared elements such as document control can be audited once, but time for each standard is still calculated separately before any reduction.
Internal effort is often the largest cost and it recurs. Your staff must build the AI system inventory, the statement of applicability, impact assessments, and the records an assessor will sample, then run internal audits and management review. An implementation partner can prepare systems and evidence under a written, fixed scope, but your organization still owns every control and must staff the decisions. Before you sign, ask a partner and each certification body to confirm in writing what is included, what the evidence deliverables are, and which costs (such as travel or remote audit time) sit outside the quote. Confirm that the certification body is accredited, because only an independent, accredited body issues a certificate that customers can verify.
Who gets paid for each part of ISO 42001 certification
This table compares each cost component of ISO/IEC 42001 certification by who is paid, whether the cost is one-time or recurring, and what drives its size. Read it as a checklist to ask each party for a written quote, since only the standard prices and the Global ACI audit time rules are fixed in public sources. The main takeaway is that the certification body's audit fees recur across the three-year cycle, while most other costs fall early.
| Cost component | Who is paid | One-time or recurring | What drives the cost |
|---|---|---|---|
| ISO/IEC 42001:2023 standard | ISO member bodies (CHF 225 for PDF or ePub, per ISO and IEC Webstore) | One-time | Number of licensed users or copies needed internally |
| ISO/IEC 42006:2025 (certifier requirements) | ISO member bodies (CHF 159, per ISO) | One-time | Optional for the organization, useful for checking certifier competence |
| Optional ISO/IEC 23894:2023 and ISO/IEC 42005:2025 | ISO member bodies (prices vary, confirm on the ISO store) | One-time, optional | Whether the team needs risk and impact assessment guidance in writing |
| Stage 1 certification body audit | Certification body, per its own quotation | One-time per certification | Audit days set by the certifier, number of AI systems and sites in scope |
| Stage 2 certification body audit | Certification body, per its own quotation | One-time per certification | Audit days, scope breadth, readiness of evidence and internal audit records |
| Surveillance and recertification audits | Certification body, per its own quotation | Recurring across the three-year cycle | Each calendar year needs at least one audit, so plan for annual fees |
| Implementation partner services | Consultant or partner, under a written fixed scope | Mostly one-time, sometimes a retainer | Gap analysis depth, number of AI systems, support for evidence and tooling |
| Internal staff time | Salaried staff (no external invoice) | One-time build, then recurring operation | Roles in AI governance, number of AI system owners, internal audit and management review effort |
| Tooling and infrastructure | Software vendors, cloud providers or hosting teams | Recurring or one-time, depending on licensing | Open-source choice versus commercial tools, hosting location and retention needs |
How certification body audit time is set
No published rule sets the audit days for an ISO/IEC 42001 certification, so the number comes from each certification body's quotation. ISO/IEC 42006:2025 adds AI-specific competence requirements for certifiers on top of ISO/IEC 17021-1, but its public summary does not describe audit time rules. The Global ACI audit time documents issued in July 2026 cover quality, environmental and occupational health and safety management systems, and none of the technical documents Global ACI listed in October 2026 names AI management systems in its title. Two bodies quoting the same scope can therefore differ in days, and you should not treat one quote as a benchmark for the other. Ask each body to state the basis it used for its day count.
Plan the fee across the full three-year cycle, not only the first audit. ISO/IEC 17021-1 requires at least one audit, surveillance or recertification in every calendar year of the cycle, so the certificate's cycle end date drives the schedule of visits. Ask the body to show a cycle plan that lists the stage 1 and stage 2 audits, each surveillance visit and the recertification audit, with the expected days for each. Confirm which of these are one-time and which recur, and whether the quote includes any extra visit needed if a major nonconformity is raised.
Ask the body to split every day into on-site and remote work. Global ACI-TECH-3-003, issued in July 2026 and implemented on 28 August 2026, governs remote auditing for conformity assessment, so the quote should state which activities it plans to run remotely and which need travel. Travel costs, including accommodation and daily allowances, are often billed separately from audit days, so request them as their own line. If you are running an integrated audit with ISO/IEC 27001, ask for the day count for each standard separately as well as the combined figure, since the combined figure is governed by the reduction rule in Global ACI-TECH-3-008.
What makes ISO 42001 certification more or less expensive
Certification body fees follow the audit time a certifier sets, and audit time follows the size and complexity of what is in scope. The six drivers below connect scope, evidence and integration, and each one has a decision you can make before you request quotes.
Number and type of AI systems
Each AI system in scope adds models, data flows, owners and evidence to sample during audits. Systems that make or inform decisions about people, or that sit in regulated processes, usually draw more audit sampling than internal productivity tools. Before quoting, inventory every AI system, mark which ones the organization builds, buys or only uses, and decide which ones sit inside the AI management system scope. A narrower, well-justified scope is the most direct way to control audit days.
Sites and locations
Each physical site or distinct hosting location can add travel, sampling and reporting effort, although remote auditing may reduce some of that cost. Ask the certification body how it will treat multiple locations, which sites it will visit, and which it will assess remotely. Consolidating AI development and operations into fewer locations, or documenting one controlled process applied across sites, typically makes the audit plan simpler to price.
Headcount and business units
The more teams that build, deploy or use AI, the more roles, competence records and interviews an auditor must cover under the competence and awareness requirements. Map who owns AI decisions in each business unit and which teams touch AI systems without owning them. A clear RACI for AI roles, kept current, reduces interview time and the number of follow-up questions an auditor raises.
Third-party AI suppliers and customer contracts
AI suppliers, model providers and customer requirements add evidence work: supplier due diligence records, contract clauses, and responsibilities split across the life cycle. Customer questionnaires that demand specific artifacts can also expand the documentation an auditor expects you to show. List every external AI dependency and every contractual AI obligation before scoping, and confirm with the certification body how it will sample supplier controls.
Evidence maturity
Organizations with a documented AI policy, completed impact assessments, versioned technical documentation and retained event logs need less time to prepare, and preparation effort is often the largest internal cost. Where those records do not exist, the work becomes a gap analysis, new procedures and a period in which the records accumulate. Ask a readiness reviewer which of the Annex A evidence items already exist in a usable form, and budget the rest explicitly.
Running ISO 27001 at the same time
Running ISO/IEC 27001 alongside ISO/IEC 42001 can reduce audit time through a single opening and closing meeting, one integrated report and shared audit of common elements such as document control. The integrated audit rules limit the reduction to no more than 20% of the combined time calculated for each standard separately. Confirm with each certification body how it calculates that combined time and whether it will quote one integrated audit or two separate audits.
How an integrated audit with ISO 27001 changes the fee
An integrated audit can reduce the audit days, but only within a limit set by the certification body's rules. Global ACI-TECH-3-008 (M), issued on 10 July 2026, applies to a certification body auditing an integrated management system, such as ISO/IEC 42001 combined with ISO/IEC 27001. The body first calculates the audit time for each standard separately, adds the two results, and then may adjust the total. The rule caps any reduction at 20% of that sum. The cap is a ceiling, not a discount the certification body must give, so the fee falls only as far as the body's own calculation and quotation allow.
The same document lists where the time savings come from. The two audits can share one opening meeting and one closing meeting, produce one integrated report, and use fewer audit team meetings. Logistics can be planned once for both standards, and common elements such as document control, internal audit and management review can be examined in one pass rather than twice. Because these savings depend on how the auditor plans the work, ask the certification body to show how each element is counted, not just the final number. Note that ISO/IEC 42006:2025 does not set audit time rules, so the AI management system days come from each body's quotation.
Before you sign, ask each certification body for the separate day count for ISO/IEC 42001 and for ISO/IEC 27001, the combined day count after the integration adjustment, and the percentage reduction it applied. Ask for the same figures for a standalone ISO/IEC 42001 audit so you can compare the two. Also confirm whether remote auditing under Global ACI-TECH-3-003 (M) is used for any stage, since that changes travel costs. Your own integration planning, including a shared document set and one internal audit programme, is what makes the savings achievable, and that work is yours or your consultant's to price separately.
The phases that drive the cost timeline
The sequence below shows the order in which ISO/IEC 42001 certification work happens, what each phase produces, and which phases trigger a fee, so you can match your budget to the calendar. No phase durations are supplied here, so request the timeline from each certification body in writing before you commit.
Scope the AI management system and run a gap analysis
Your team defines which AI systems, products, business units and locations fall inside the AI management system, then compares current practice against the clause 4 to 10 requirements and the Annex A controls. This work is usually done by your own staff, with an implementation partner if you hire one. It is done when you hold a written scope statement and a gap list that names an owner for each gap. The gap list is the main driver of later internal effort, so the scope decision made here shapes most of the cost that follows.
Write the statement of applicability
You document every Annex A control, state whether it is implemented, and justify each inclusion or exclusion as clause 6.1.3 requires. Your AI governance owner and control owners do this work, and a legal or privacy reviewer often checks exclusions. It is complete when each control has a justification and an evidence location. Certification bodies review this document during the first audit stage, so a vague statement often produces follow-up questions and additional audit time.
Operate the system and run internal audit and management review
You run the AI management system long enough to produce records: risk and impact assessments, competence records, policy approvals, and corrective actions. You then conduct an internal audit and a management review, and record the results. Internal staff perform these tasks, though some organizations use an outside auditor for independence. The phase is done when internal audit findings are closed or have a dated plan, and management has minuted its review. Certification bodies expect this evidence before they schedule stage 1.
Pay the certification body for the application and the stage 1 audit
You select a certification body, obtain a written quotation, and sign an agreement. The first certification fees fall due at this point, and the quotation sets the audit days for each stage. Stage 1 is a documentation review, in which the auditor checks scope, the statement of applicability and readiness for the certification audit. It produces a stage 1 report that lists any gaps to close. Ask the body how it sets audit time for an AI management system, because the published rules for AI-specific audit time are limited and the quotation is where that assumption is stated.
Close stage 1 findings and complete the stage 2 audit
You address the findings from stage 1, often by updating documents or adding evidence, and then the certification body runs stage 2 on site or remotely. Stage 2 tests whether the system operates as documented across your AI systems in scope. Remote auditing may reduce travel costs under the ICT guidance that applies to conformity assessment. The stage 2 phase ends when the auditor issues a recommendation, and it is a second fee event. Budget for re-audit time if the auditor identifies nonconformities that need a follow-up visit.
Receive the certificate and confirm its cycle dates
After the certification body's internal review of the audit file, it issues the certificate. Check that the certificate shows the date on which the three-year cycle completes, because fees are planned against that cycle. Verify the certificate with the certification body and, if you want the accreditation status confirmed, with the national accreditation body or IAF CertSearch. The certificate is the output of this phase, and it starts the surveillance schedule.
Complete the first surveillance audit
Within the first calendar year after certification, the certification body performs at least one surveillance audit. This is a recurring fee event that samples your AI management system and checks corrective actions from earlier findings. You prepare updated risk and impact records, internal audit results and management review minutes for the auditor. The phase is done when the surveillance report is accepted and the certificate remains valid. Ask the certification body for the surveillance audit days and fee in the quotation, since they recur in every year of the cycle.
Who pays for which work in ISO 42001 certification
The organization owns its AI management system, its AI policy, its risk and impact decisions and its statement of applicability. Those decisions cannot be handed to a consultant or an auditor, because the certificate describes what the organization itself governs. Internal cost is mostly staff time, and it recurs every year because the management system has to keep operating between audits.
- Accountable decisions: Top management approves the AI policy, the scope and the justification for each Annex A control included or excluded in the statement of applicability.
- Internal audit and management review: Staff run the internal audit and the management review that clause 9 requires, and they act on the findings.
- Day-to-day operation: Product, data and engineering teams keep AI system records, impact assessments and monitoring current.
- Certification body fees: The organization pays the certification body directly, under a quotation based on its scope and audit time.
- Standards purchase: The organization buys ISO/IEC 42001 and any companion guidance it chooses to use.
Before signing, confirm which of these decisions your own leadership must make, and budget the internal hours for them as a recurring line rather than a one-time project cost.
An implementation partner such as DeployOpen helps prepare the system and the evidence that the organization presents to the auditor. Typical work includes a gap analysis against Annex A, drafting or tailoring documentation, setting up the tooling that produces records, and technical testing of AI systems. The partner is paid under a written scope and does not decide whether the organization passes.
- Gap analysis: Comparing current practice with the clauses and the chosen Annex A controls, and listing what is missing.
- Documentation support: Drafting procedures and templates that the organization reviews, approves and owns.
- Evidence preparation: Configuring logging, access records and self-hosted tooling so that evidence is generated during normal operation.
- Technical testing: Security and application testing of AI systems that feeds the verification and validation evidence.
- Independence boundary: The partner cannot issue the certificate, cannot issue an audit report, and should not sign off its own work as conformity evidence.
Ask for the written scope to name each deliverable and state which items the organization must approve. Confirm that the partner will not also serve as the certification body for the same engagement.
The certification body is the only party that performs the audit and issues the certificate. It works under ISO/IEC 17021-1, and for AI management systems it also applies the additional requirements of ISO/IEC 42006:2025. ISO does not certify organizations, so the body and its fees are chosen by the organization, ideally after comparing several bodies.
- Audit stages: A stage 1 review of documentation and readiness, then a stage 2 audit of implementation.
- Ongoing audits: Surveillance audits in each year of the three-year cycle, then recertification.
- Fees: Set by each body in its own quotation, based on audit time and scope. ISO/IEC 42006:2025 does not set audit time rules for AI systems, so the days come from each quotation.
- Competence: Auditors must be competent for AI management systems, which ISO/IEC 42006 addresses.
- Independence: The body should not design the system it audits. If it prepares your documentation, its impartiality on that same scope is open to challenge.
Before engaging a body, confirm that its certificate for AI management systems is accredited and ask for the audit day calculation in writing.
What usually inflates ISO 42001 cost and how to avoid it
Most of the extra spend on ISO 42001 certification comes from decisions made before the first audit day is booked. The cards below cover the decisions that most often add audit days, purchases and rework, and the check that prevents each one.
Unclear scope adds audit days
Certification bodies set audit time from the number of sites, AI systems, staff and processes inside the scope. If the scope statement is vague about which AI systems, business units and suppliers are covered, the auditor will either widen the audit or ask for a second visit. Before requesting quotes, write the scope as a list of named AI systems and the teams that build, provide or use them, and ask each certification body to quote against that list.
Buying companion standards without a need
ISO/IEC 42001 itself is the requirement document, and ISO/IEC 23894 and ISO/IEC 42005 are optional guidance. Buying them is reasonable only when a specific Annex A control or internal process needs that guidance, such as a risk method or an impact assessment template. Map each purchase to a control in your statement of applicability, and skip the rest until an auditor or internal team asks for it.
Certifying before evidence exists
A stage 2 audit tests whether the management system operates, which means records from internal audits, management review and AI risk and impact assessments should already exist. If the policies are approved but no operating records exist, the certification body may find nonconformities, and the organization pays for a follow-up visit or a repeat audit. Run the management system for a period first, and confirm with the certification body what evidence it expects at each stage before booking.
Ignoring accredited versus unaccredited status
ISO describes accreditation of certification bodies as voluntary, and an unaccredited certificate is not necessarily worthless, but its acceptance depends on your customers and regulators. Choosing a cheap body without checking accreditation can leave you with a certificate that a key customer will not accept, which means paying again for a second certification. Ask each body whether its certificate is accredited, which accreditation body granted it, and whether that accreditation covers AI management systems, then verify the answer independently.
Underestimating internal effort
Fees from the certification body are only part of the cost. Someone must maintain the AI inventory, write and approve the AI policy, run the internal audit, prepare for management review and answer auditor questions. Estimate those hours before budgeting, assign a named owner for AI governance, and ask the certification body and any consultant to state which tasks they perform and which stay with your team.
Paying twice for overlapping audits
ISO/IEC 42001 and ISO/IEC 27001 share a harmonized structure, so a certification body can audit common elements such as document control once. Under the Global ACI integrated audit rule, audit time for each standard is calculated separately, then added and adjusted, and any reduction is capped at 20 percent of the sum. Ask for an integrated audit quote that shows the time per standard and the reduction applied, rather than two separate audit plans.
What to ask for in a certification body quote
A comparable quote has to show the work behind the fee, or two offers cannot be set side by side. Ask each certification body for audit days broken out by stage, meaning stage 1, stage 2, and then each surveillance year within the three-year cycle. European Accreditation's FAQ 51.7 notes that the certificate must show when the cycle completes, so the quote should also show how the three years are counted and when recertification falls. ISO advises comparing several certification bodies, and the quote is where that comparison becomes concrete. Ask each body to confirm it uses the relevant CASCO standard, which for certification bodies is ISO/IEC 17021-1 with the AI-specific requirements of ISO/IEC 42006:2025 added on top. ISO does not publish audit time rules for AI management systems, so the days in each quote come from that body's own calculation and should be explained as such.
Confirm accreditation before you compare prices. Ask whether the body is accredited for ISO/IEC 42001 specifically, not just for management system certification in general, and ask for the accreditation scope in writing. Then verify it yourself with the national accreditation body or through IAF CertSearch, because a quote is not evidence of accreditation. ISO describes accreditation as voluntary, so an unaccredited certificate is not automatically worthless, but you need to know which kind you are buying before you plan around it. If you plan an integrated audit with ISO/IEC 27001, ask the body to show how it calculated time for each standard separately, added them, and applied any reduction. Global ACI-TECH-3-008 caps that reduction at 20% of the combined sum, so a quote claiming a larger saving needs an explanation. Ask too whether remote auditing is assumed for any part of the work and how the quote treats travel, under Global ACI-TECH-3-003.
Finally, ask what is excluded. Quotes often leave out certificate issuance fees, additional audit days after a nonconformity, the cost of re-audits, travel and subsistence, and changes in scope such as adding a product or site. Ask for the rates or conditions that apply to each of these, and for the quote's validity period. Keep one written scope document alongside the quote so that the number of sites, the scope of the AI management system and the controls in the statement of applicability are the same in every offer. Where a body's figures cannot be traced to that scope, treat the quote as incomplete and ask again before you choose.
ISO 42001 certification cost questions buyers ask
How much does ISO 42001 certification cost in total?
No single total applies to every organization, because the cost is the sum of several separate items: the standard and its companion documents, the certification body's audit fees across the three-year cycle, internal staff time, and any tooling or outside help you choose to buy. The certification body sets its own fees and issues the certificate, so the audit quote is the figure to compare. Ask each certification body for a written quotation that shows audit days per stage, surveillance and recertification years, travel, and how remote auditing is priced. The scope of your AI management system, the number of AI systems and sites, and how mature your existing governance records are will move the total more than any fixed rule.
Do we have to buy ISO/IEC 42001 to get certified?
Yes, you need access to the standard to implement it, and the purchase is a one-time cost. ISO lists ISO/IEC 42001:2023 at CHF 225 as a PDF and ePub, and the IEC Webstore shows the same price. Your team will also likely want ISO/IEC 42006:2025, which sets requirements for certification bodies and is listed by ISO at CHF 159. This document is mainly useful to understand how your certification body will be assessed, so it is optional for the implementing team. Optional companion guidance such as ISO/IEC 23894:2023 on AI risk management and ISO/IEC 42005:2025 on AI system impact assessment is also available, and buying it is a choice, not a certification requirement.
Does ISO set the certification fees?
No. ISO does not certify organizations or issue certificates, and external certification bodies set their own fees. ISO advises comparing several certification bodies, checking that they use the relevant CASCO standard, and checking whether they are accredited. Accreditation is voluntary, so an unaccredited body is not necessarily disreputable, but the certificate may carry less weight with your customers or regulators. You can check accreditation status with the national accreditation body or IAF CertSearch. When you compare fees, confirm that each quotation covers the same scope, the same audit days and the same certificate validity rules.
How long is the ISO 42001 audit cycle, and why does it matter for cost?
The certification cycle is three years. European Accreditation's FAQ 51.7 (March 2026) states that under ISO/IEC 17021-1 the cycle is three years and the certificate must show the date the cycle completes, so fees are usually planned across that full period. European Accreditation FAQ 37.12 also states that ISO/IEC 17021-1 requires at least one audit, surveillance or recertification in every calendar year of the cycle. This means you should budget for the initial certification audit, the yearly audit activity in the years that follow, and the recertification audit at the end of the cycle. Ask each certification body to show all of these events in one schedule so you can compare the full three-year cost.
Is an integrated ISO 42001 and ISO 27001 audit cheaper?
It can reduce audit time, but the reduction is limited and it is set by the certification body. Global ACI-TECH-3-008 (M), issued 10 July 2026, requires a certification body auditing an integrated management system to calculate audit time for each standard separately, add them, and then adjust. Any reduction may not exceed 20% of that sum. The same document lists the sources of savings: one opening and one closing meeting, one integrated report, optimized logistics, fewer audit team meetings, and auditing common elements such as document control at the same time. Note that the Global ACI audit time rules do not name AI management systems in their titles, so ask each certification body how it calculates AI management system days before you assume any saving.
Can we get ISO 42001 certified without a consultant?
Yes, an organization can implement the management system and prepare for certification with its own staff. The organization owns its AI policy, its statement of applicability, its risk and impact assessments and its management review, and no outside party can take those decisions for it. A consultant or implementation partner can help with gap analysis, documentation, evidence collection and tooling, but that help is an optional cost. Your decision should depend on how much AI governance experience your team has, how many AI systems are in scope, and how much time your staff can give to the project. Whatever you choose, keep the consultant independent from the certification body, because the certification body must audit the system without having designed it.
How much internal effort should we plan for ISO 42001?
The main internal effort is people time, and it recurs. Plan for a project owner, system owners for each AI system in scope, staff who maintain records for resources, data, life cycle and use, and a person who runs internal audit and management review. Effort is highest during scoping, the gap analysis and the first full cycle of impact assessments and documentation. It then drops to ongoing operation, change control for AI systems, internal audits and surveillance preparation. Ask your certification body and any partner to estimate effort in writing against your scope, and keep your own time records so you can check the estimate against actual work.
What tooling costs should we expect for ISO 42001?
Tooling is optional, but it recurs and it should be costed separately from the audit. Some organizations use open-source tools to keep AI governance records, inventories, risk registers and evidence in a self-hosted environment inside their own infrastructure. Other costs can include hosting, backup, access control, and time to configure and maintain the tools. Commercial governance platforms carry license fees that vary by vendor, so request those prices directly from each vendor. Confirm that any tool can export the records your certification body will sample, because auditors need to see the evidence, not the tool. DeployOpen implements and supports self-hosted open-source platforms inside a client's own infrastructure, and any cost for that work follows a written scope agreed before work starts.
How DeployOpen scopes and prepares ISO 42001 evidence
DeployOpen starts with a written scope that states which AI systems, teams and Annex A controls the certification will cover, so cost drivers are visible before work begins. We then prepare the systems and evidence an independent certification body will review, while the organization keeps ownership of its AI management system and the certification decision.
How we scope
- Written scope names the AI systems, business units and sites that the ISO 42001 management system will cover.
- Scope notes list which Annex A controls are in the statement of applicability and why others are excluded.
- Scope also states whether an integrated audit with ISO/IEC 27001 is planned, since that changes audit time.
How we build
- We set up the evidence trail for AI policy, roles, impact assessments and supplier records on self-hosted platforms.
- We configure logging, document control and access records inside your own cloud accounts or data centers.
- We test the controls we deploy and record the results so your internal audit team can review them.
How we hand over
- Handover includes documented procedures, evidence maps and configuration records owned by your organization.
- We walk your compliance and engineering staff through the evidence so they can answer assessor questions.
- You receive a list of open items and the owner for each, so remaining effort is clear before the certification body audit.
How we support
- Fixed-scope engagements end with agreed deliverables, not open-ended hours, so cost stays tied to the written scope.
- Ongoing support, upgrades and continuous testing are available as a retainer for surveillance years.
- We do not issue audit reports or certificates. Independent certification bodies make that decision, and we confirm which one you plan to use.
