Is ISO 42001 certification accredited? ANAB and Global ACI

Is ISO 42001 certification accredited, and does that matter for your customer or regulator?

When a customer, contract or regulator asks for ISO 42001 certification, the first question is whether the certificate will be accepted. ISO does not certify organizations. External certification bodies do, and accreditation of those bodies is voluntary. ISO/IEC 42006:2025, published on 7 July 2025, adds requirements on top of ISO/IEC 17021-1 for bodies that certify AI management systems. However, as of Global ACI-FMRA-001 version 3.3 (5 August 2026), ISO/IEC 42001 is not listed as an endorsed sub-scope of the Global ACI arrangement, so no accreditation body's recognition under that arrangement can be taken as covering ISO/IEC 42001 today.

The answer depends on three things about the specific certificate: which certification body issued it, which accreditation body accredited that certification body, and what scope that accreditation covers. A certifier may hold accreditation for ISO/IEC 27001 while holding none for ISO/IEC 42001, so a general accreditation claim is not enough. Ask the certification body for its accreditation certificate and the exact standard and version it covers. Then confirm the status through the accreditation body's directory or the IAF CertSearch tool, which the Global ACI site links to for verification. Also check the certificate's scope statement against the services the customer actually buys.

Roles matter here. The organization owns its AI controls and its statement of applicability. An implementation partner can prepare systems, documentation and evidence, but it cannot issue or sign off a certificate, and its involvement should be disclosed to the certification body. Only an independent certification body issues the certificate. If the certifier cannot show current accreditation for ISO/IEC 42001, ask the customer or regulator whether they will accept an unaccredited certificate or a different assurance report before you commit to the audit. Counterfeit certificates are a known risk, so confirm the certificate number directly with the issuing body rather than relying on a copy.

What ISO/IEC 42006 adds for certification bodies auditing AI management systems

ISO/IEC 42006:2025 sets the rules that certification bodies must meet before they can audit an AI management system against ISO/IEC 42001. It was published on 7 July 2025 as edition 1 (31 pages) by ISO/IEC JTC 1/SC 42, after its FDIS ballot closed on 17 April 2025. The standard does not replace ISO/IEC 17021-1, the general requirements for bodies certifying management systems. It adds AI-specific requirements on top of it, so a certification body that already meets 17021-1 still needs to show it can audit AI governance competently, impartially and consistently. ISO says the standard is intended for two audiences: the certification bodies that perform ISO/IEC 42001 audits, and the accreditation bodies that assess them.

Because 42006 sits on top of 17021-1, the accreditation scope is where the reader should look. ISO also notes that its requirements can be built into product, process or service certification schemes operated under ISO/IEC 17065, which means a scheme owner may apply AI-specific rules outside a management system audit. For a buyer, the practical question is whether a certifier's accreditation explicitly covers ISO/IEC 42001 and whether its assessment took 42006 into account. Ask the certification body to name the accreditation body, the accredited scope and the document references in that scope, and to confirm in writing how its accreditation addresses 42006. Do not accept a general statement that the body is "accredited for AI" without the scope document.

Do not assume that any accreditation body has already completed this assessment for a given certifier. At the time of writing, the Global ACI recognition arrangement does not list ISO/IEC 42001 as an endorsed sub-scope, so the reader must verify the status directly with the certifier and the accreditation body, and check the scope against the certificate and the IAF CertSearch database. Confirm the edition of 42006 the accreditation body references, since a scope that cites an older or undefined document needs follow-up before you rely on the certificate in a customer or regulatory submission.

What the Global ACI arrangement does and does not list for ISO 42001 today

The Global ACI arrangement is the layer that decides which accreditation and certification scopes are recognized across borders. The four cards below separate what has changed in that layer from what has not, so you can read a certificate's accreditation status against the current listing rather than against assumptions.

IAF functions passed to Global ACI

The International Accreditation Forum ceased operations on 1 January 2026. Its role, and that of ILAC, passed to Global Accreditation Cooperation Incorporated (Global ACI), which now runs the Global ACI Multilateral Recognition Arrangement (MRA). If a document or certificate still cites IAF membership as the recognition basis, ask which Global ACI arrangement now covers it. Older accreditation certificates may name the former body, so check the current accreditation body's scope listing rather than the legacy reference.

MRA-001 places certification in main scope

Global ACI-MRA-001 version 2.0 (May 2026) places certification of management systems in the MRA main scope. It names ISO/IEC 17021-1 as the level 3 normative document that accreditation bodies use to assess certification bodies. This means the framework for management system certification is recognized, but it does not by itself confirm that ISO 42001 is an endorsed sub-scope. Read the main scope as the general rule and the sub-scope list as the specific answer.

No ISO 42001 endorsed sub-scope

Global ACI-FMRA-001 version 3.3 (5 August 2026) lists ISO/IEC 27001:2022 with ISO/IEC 27006-1:2024 as an endorsed management system sub-scope. It contains no entry for ISO/IEC 42001 or ISO/IEC 42006. Do not describe any certification body as recognized under the arrangement for ISO 42001. Ask the body to show its accreditation scope for ISO/IEC 42001 and confirm it is listed in the current FMRA-001 document.

Accredited certificates still possible

The absence of an endorsed sub-scope does not stop an accredited certification body from issuing an ISO 42001 certificate, provided its national accreditation body has assessed it against ISO/IEC 42006 and ISO/IEC 17021-1. For example, a certificate from a body accredited by ANAB for AI management systems carries accreditation at the national level, even while the Global ACI listing is absent. Check the accreditation scope on the certificate and in the accreditation body's directory, not only the certification body's marketing. Confirm that your procurement team accepts national accreditation as sufficient for the contract.

How to check ANAB accreditation for a certification body

If a supplier hands you an ISO/IEC 42001 certificate and you must rely on it, your question is whether the issuing body was accredited for this scope when it issued the certificate. The certificate itself is a claim by the certification body, so you need to test that claim against the accreditation body's records. Start by noting the certification body's name, the certificate number, the issue date and the scope statement printed on the certificate.

Name of the certifier: Record the exact legal name of the certification body as printed on the certificate, not the supplier's description of it.
Accreditation body: Confirm which accreditation body granted accreditation, for example ANAB or another national body, and search its public directory for that certifier.
Status on the issue date: Check that accreditation was in force when the certificate was issued, not only today.
Scope match: Confirm that the accredited scope names ISO/IEC 42001 and that the certificate's scope of AI activities falls within it.
Certificate status: Verify the certificate's current status through the verification route the certifier or the accreditation body publishes.

If any of these checks fails or cannot be completed, ask the supplier for written confirmation from the accreditation body before you accept the certificate as evidence.

How to verify an ISO 42001 certificate before you rely on it

This sequence confirms that a certificate exists, was issued by a body whose accreditation you can check, and covers the AI systems and services you depend on. Each step leaves a dated record in your supplier file.

Obtain the certificate from the provider
Ask the organization for the current ISO/IEC 42001 certificate, or find it on its trust or compliance page. Where the provider makes certificates available through a compliance portal, download the copy from there. Do not rely on a logo, a badge or a statement in a questionnaire. The output is a copy of the certificate file saved to the supplier file with the date you received it.
Record the certificate details
Note the certification body's name, the certificate number, the scope statement, the issue date and the expiry or next audit date printed on the certificate. Compare the organization's legal name and sites against the certificate so the entity named matches the one you are contracting with. The output is a short record in the supplier file listing each field and the date you recorded it.
Confirm the certification body's accreditation
Find the certification body's own accreditation with its national accreditation body and check that the scope of that accreditation includes management system certification to ISO/IEC 42001. Ask the accreditation body's public directory or the certification body for its accreditation certificate if you cannot find it. Note that ISO states accreditation of certification bodies is voluntary, so a certificate issued without accreditation is possible and should be treated differently. The output is a dated note stating whether accreditation was confirmed and for which scope.
Search IAF CertSearch
Search the certificate in IAF CertSearch, which ISO describes as combining accreditation and certification data from accreditation and certification bodies. You can check one certificate at a time, and the tool also supports bulk checks and an API for teams that monitor many suppliers. Global ACI links to the same tool for verification. The output is a dated record of the result, including the status shown and a screenshot or export saved to the file. If the certificate does not appear, do not assume it is invalid. Ask the provider and the certification body to explain why before you proceed.
Check the scope against your dependencies
Read the scope statement and list the AI systems, products and services you rely on. Confirm that each one is named in scope, or that the scope clearly covers it. Provider certificates often list specific in-scope services, so a certified platform may not cover every feature you use. For example, in AWS's published FAQ, customers obtain the certificate through AWS Artifact, and the certificate lists the in-scope services. Schellman Compliance, LLC, an ISO certification body accredited by the ANSI National Accreditation Board (ANAB), verifies AWS's ISO/IEC 42001:2023 certification. This is one provider's arrangement, and other providers may publish their certificates and scope differently. The output is a scope gap list sent to the provider for written confirmation.
Record the check date and schedule a recheck
Date the completed verification, name the person who performed it, and file it with the certificate copy and the search results. Set a reminder to repeat the search before the certificate's expiry date and whenever the provider announces a scope change. The output is a single dated verification entry in the supplier file that another reviewer can follow without repeating the work.

Where counterfeit or misdescribed certificates create risk

A certificate can be genuine on paper and still fail a buyer's check. The four cards below cover the most common ways an ISO 42001 claim is copied, misdescribed or overstated, and what to verify before relying on it. Each one turns on the same question: can the certificate be traced to an accredited body, for this standard, covering the AI system in use?

Copied or expired certificates

A certificate document can be copied from another organization, altered to show a different name, or kept in circulation after its validity has ended. A PDF alone proves little, because anyone can reproduce one. Ask the supplier for the certification body's name, the certificate number and the expiry date, then check the status directly in IAF CertSearch, which can verify a certificate one at a time, in bulk or through an API. Also check that the certificate names the organization you are contracting with, not a parent or affiliate.

Certifier without matching accreditation

A certification body may hold accreditation for other standards but not for ISO/IEC 42001, or its accreditation may not name the standard in its scope. Accreditation is voluntary, so a certifier can operate without it. Ask which accreditation body assessed the certifier, whether the accreditation scope lists ISO/IEC 42001 explicitly, and whether the certifier is accredited to ISO/IEC 42006 requirements. A certificate from an unaccredited body can still exist, but it carries less assurance for a customer or regulator.

Scope that excludes the AI system

A certificate may cover a product line, a business unit or a team, while the AI system a buyer actually uses sits outside that scope. Scope statements are where this gap usually hides. Compare the listed products, services and locations against the system in your contract, and confirm which AI systems are covered by the AI management system. Clause 6.1.3 requires a statement of applicability, so ask the supplier for that document alongside the certificate to see which Annex A controls were included or excluded.

Claimed Global ACI recognition for ISO 42001

Some suppliers describe ISO/IEC 42001 certificates as recognized under the Global ACI arrangement. As of Global ACI-FMRA-001 version 3.3, ISO/IEC 42001 is not listed as an endorsed sub-scope, unlike ISO/IEC 27001 with ISO/IEC 27006-1. Treat any claim of international recognition for ISO 42001 as unverified until the arrangement's published lists show it. Ask the certification body for its counterfeit-risk policy, referencing Global ACI-TECH-3-015 (I), an informative document on risk policy for counterfeit certificates, and ask how it handles verification requests from buyers.

Which certification option fits your customer or regulator

This table compares three kinds of ISO/IEC 42001 certificate by when each fits, what to verify and what the customer must accept. Read it as a decision aid: the certificate type you can rely on depends on the accreditation scope a certification body actually holds, and on what your customer or regulator has written down.

Option	When it fits	What to verify and what to ask the customer to accept
ANAB-accredited body with ISO/IEC 42001 in scope	Customer questionnaires, procurement rules or regulator text that ask for accredited certification and do not name a specific body	Confirm the body's ANAB listing covers ISO/IEC 42001 and that the certificate's scope matches your AI systems. Ask the customer to accept a certificate issued under that accreditation without further conditions.
Body accredited by another accreditation body, scope names ISO/IEC 42001	Organizations that already use a non-US certification body, or customers in regions where another national accreditation body is preferred	Check the scope entry against Global ACI and IAF CertSearch, not only the body's own marketing. Ask the customer whether that accreditation body's signature is acceptable under their supplier rules.
Body with no confirmed accreditation for the standard	Early certifications where the customer has no accreditation requirement and accepts a conformity statement as an interim step	Do not treat it as accredited. Get the customer's written agreement that they accept a non-accredited certificate, and confirm the certificate's status with the issuing body before relying on it.
Regulator requirement	Any filing or supervisory process that names a specific certificate type	Confirm the requirement in writing with the regulator or in the governing text. This table does not establish that any option satisfies a regulator.
Verification source	Every option, at the time of contracting and at each renewal	Use IAF CertSearch and the certificate's own reference number. Record the check date and the name of the person who checked, and repeat the check at each surveillance audit.
Counterfeit risk	Any certificate received as a PDF or copy from a supplier	Compare the certificate's details with the registry entry rather than the copy. Global ACI's informative guidance on counterfeit certificates sets out how accreditation bodies expect this risk to be managed.
Customer acceptance record	Option two or three in any contract	Ask the customer to sign a short acceptance covering the certificate type, its accreditation status on the verification date and any conditions for replacement.

Questions buyers ask about ISO 42001 accreditation and certificates

Does ISO 42001 certification have to be accredited?

No. ISO does not certify organizations, and external certification bodies issue certificates. ISO states that accreditation of those certification bodies is voluntary, so a certificate's validity for your customers depends on who issued it and what that body is accredited to do. Before you rely on a certificate, confirm that the certification body is accredited for ISO/IEC 42001 specifically, not only for general management system standards. Customers, procurement teams and regulators will read the certificate and its accreditation status, so ask your certification body which accreditation covers the audit and who the accreditation body is. Accreditation is a decision your contracts and risk owners should make, and it should be written into the requirements you give the certification body before you book an audit.

Does ANAB accredit ISO 42001 certification bodies, and how do I confirm the scope?

Yes, ANAB, the ANSI National Accreditation Board, accredits certification bodies for ISO/IEC 42001, and certificates issued by its accredited bodies are a common reference point. An example is Schellman Compliance, LLC, an ISO certification body accredited by ANAB, which verifies AWS's ISO/IEC 42001:2023 certification. Accreditation is granted for a defined scope, so do not stop at the accreditation body's name. Ask the certification body for its current accreditation certificate and check the listed scope, the standard edition and the accreditation status on the accreditation body's own records. Confirm with ANAB directly if the record is unclear. Verify this before contracting, because scope gaps usually surface only at the audit.

Does the Global ACI arrangement cover ISO 42001 certification today?

Not yet, as far as the supplied record shows. Global ACI's MRA places certification of management systems in its main scope, and the Global ACI-FMRA-001 list of endorsed sub-scopes, version 3.3, includes ISO/IEC 27001:2022 with ISO/IEC 27006-1:2024. It does not list ISO/IEC 42001 or ISO/IEC 42006. This means a certificate for ISO 42001 cannot rely on the endorsed multilateral recognition route that ISO 27001 certificates use. Check the current version of the Global ACI document before you decide, because the list can change. Ask your certification body whether its accreditation was granted through a national accreditation body and which recognition arrangements, if any, apply to its ISO 42001 scope.

How do I verify an ISO 42001 certificate with IAF CertSearch?

Use IAF CertSearch, the database ISO describes as combining accreditation and certification data from accreditation and certification bodies. You can check a certificate's status one at a time, in bulk or through an API, and Global ACI links to it for certificate verification. Search for the certification body and the organization, then confirm that the certificate is current, that the standard is ISO/IEC 42001, and that the scope lists the products, services or sites your customer is buying. Also check the certificate's expiry date and whether it has been suspended or withdrawn. Record the date and the search result in your supplier file, because certificate status changes over the three-year cycle. Verification does not replace reading the certificate itself.

What must my organization do itself, and what can a consultant help with?

Your organization owns its AI governance, its controls and its decisions. This includes setting the AI policy, deciding which Annex A controls apply in the statement of applicability, approving AI systems for deployment, and running internal audit and management review. An implementation partner or consultant can help prepare systems, documentation and evidence, and can help you understand the scope of the certification body's accreditation. A consultant cannot issue the certificate or determine whether accreditation is adequate. Independent auditors and certification bodies do that. Keep the certification body independent of your implementation partner, and ask the certification body in writing which evidence and scope it expects before work starts.

How does accreditation affect ISO 42001 cost and timing?

Accreditation affects cost and timing mainly through the certification body you choose and the scope it can cover. Cost drivers include the number of AI systems and sites in scope, the number of audit days the certification body plans, the complexity of your AI use and supply chain, and the number of nonconformities that need follow-up. Choosing a body whose accreditation does not cover your intended scope can force a second audit or a change of certification body, which adds cost and delay. Ask each certification body for a written quote that states the accredited scope, the audit days, the stage 1 and stage 2 plan, and the surveillance terms. Your implementation partner's fee is a separate cost, and it should be quoted from a written scope that you agree before work starts.

How DeployOpen prepares your AI governance evidence for an accredited certification audit

DeployOpen helps organizations prepare the systems, controls and evidence that an ISO 42001 certification body will examine. We do not issue reports or certificates; the accredited certification body does, so we focus on making your AI governance records complete, traceable and ready for an assessor to test. Accreditation status is confirmed by you before any work is scoped.

How we scope

Confirm the certification body and its accreditation scope for ISO/IEC 42001 before work starts, using the accreditation body's public listing.
Agree in writing which AI systems, business units and Annex A controls fall inside the engagement and the statement of applicability.
Record who owns each control inside your organization, since DeployOpen prepares evidence but does not own your AI governance decisions.

How we build

Set up self-hosted open-source tooling inside your own cloud accounts or data centers to hold AI risk, impact and inventory records.
Configure logging, access controls and version history so that approvals and changes to AI systems leave a verifiable trail.
Test the controls you have claimed in the statement of applicability and record the results for the certification body to review.

How we hand over

Deliver an evidence index mapping each claimed control to its records, owners and storage location, so an assessor can trace each claim.
Document configuration, runbooks and the known gaps that remain open, so your team can explain them during the audit.
Transfer administration to your staff with written procedures, so the evidence stays usable after the engagement ends.

How we support

Offer ongoing support, upgrades and continuous testing as a retainer for the period between audits and surveillance reviews.
Help your team answer follow-up questions from the certification body, based on the evidence already in place.
Confirm with the certification body which evidence it expects at each audit stage, since its requirements are set by its own accreditation.

Is ISO 42001 certification accredited? ANAB and the Global ACI arrangement