What does an ISO 42001 consultant do, and what drives the cost?
If a customer questionnaire, contract or regulator points you to ISO/IEC 42001, an outside consultant or implementation partner can plan, build and prepare the AI management system and its evidence. The organization still owns its controls and decides what is in scope, and only an independent certification body can certify the system. In practice, a partner typically runs a gap analysis against the clauses 4 to 10 and the Annex A controls, drafts the AI policy and role assignments, supports AI impact assessments, and sets up the records an auditor will sample. Ask each firm to state in writing which of these tasks it performs and which remain with your staff.
The price depends on scope, not on a fixed package. The main drivers are the number of AI systems in the boundary, how many of them process personal data or affect people in regulated decisions, how many third parties supply models, data or hosting, and how mature your existing documentation and internal audit already are. Your organization also pays for internal time, which recurs through surveillance and management review, so ask quotes to split one-time build work from ongoing support. The published standard is a fixed cost: ISO lists ISO/IEC 42001:2023 at CHF 225 for the PDF and ePub version, and the IEC Webstore lists the same price. Companion guidance such as ISO/IEC 23894:2023 or ISO/IEC 42005:2025 adds purchase cost, and ISO offers bundles at CHF 340 (with ISO/IEC 27001:2022) and CHF 365 (with ISO/IEC 42005:2025), each a 10% discount on the separate prices.
Independence shapes the buying decision. Under ISO/IEC 17021-1, consultancy from a body related to the certification body is a significant threat to impartiality, and a recognized mitigation is that the certification body does not certify that system for at least two years after the consultancy ends (European Accreditation FAQ 33.15). Before you sign, confirm that your consultant is not related to the certification body you plan to use, and ask each certification body for its own quotation, since ISO's summary of ISO/IEC 42006:2025 does not set audit days. Request a written scope, a list of deliverables and the named people who will do the work.
Who gets paid for what in an ISO 42001 project
This table separates each cost in an ISO 42001 project by who receives the money, whether it is one-time or recurring, and what moves it up or down. Use it to build a quote request that compares like with like. The main takeaway is that the standard itself is a small, fixed purchase, while the largest variable costs are staff time, the implementation partner's scope and the certification body's audit days.
| Cost component | Who is paid | One-time or recurring | What drives it up or down |
|---|---|---|---|
| ISO/IEC 42001:2023 standard | ISO or IEC (sold through their webstores) | One-time, CHF 225 per the ISO and IEC Webstore prices | Buying the PDF or ePub is fixed; the cost changes only if you buy bundles, such as the CHF 340 ISO/IEC 27001 package |
| Companion guidance (ISO/IEC 23894:2023, ISO/IEC 42005:2025) | ISO or IEC | One-time, optional; the CHF 365 bundle with ISO/IEC 42005:2025 is priced per ISO | Needed only if your risk or impact method requires it; many teams reuse free public guidance instead, so confirm whether your certification body expects it |
| Implementation partner fixed-scope fee | The implementation firm, under a written scope | One-time for gap analysis, policies, impact assessments and evidence set-up; retainers can recur | Number of AI systems in scope, number of Annex A controls in the statement of applicability, existing ISO 27001 maturity, and how many systems and suppliers need evidence |
| Internal staff time | Your own payroll (not an external invoice) | Recurring in practice: owners of controls, system owners and reviewers keep working after certification | Clarity of roles under clause 5.3 and A.3.2, number of AI use cases, and how much evidence already exists in tickets, logs and documents |
| Tooling and infrastructure | Your cloud, hosting or software vendors | Mostly recurring (licenses, hosting, storage for logs and evidence) | Open-source tools reduce license cost but still need hosting and maintenance; confirm which evidence sources your AI platforms already produce |
| Certification body audit fee | The accredited certification body, under its own quotation | Recurring: initial certification, then surveillance and recertification audits | Audit days set by each certification body, the size and complexity of the AI management system, and the number of sites; ask for the day breakdown in writing |
| Consultant independence check | Not a separate fee; a constraint on who may do which work | One-time check at selection | If the consultant belongs to the same group as the certification body, the body may need a waiting period before certifying that system; ask both parties to confirm in writing |
What makes an ISO 42001 consultant engagement cost more or less
Consultant fees follow the amount of work the written scope creates, not the standard's page count. The cards below cover the buyer decisions that widen or narrow that work, and the controls a buyer can use to hold each one in place before a quote is signed.
Scope boundary and business units
Decide which AI systems, products, internal teams and business units fall inside the management system. A narrow boundary that names specific systems and owners means fewer interviews, fewer impact assessments and less evidence to collect. Ask the consultant to restate the boundary in the scope statement and show how each excluded area is justified in the statement of applicability under clause 6.1.3.
Number and risk of AI systems
Each AI system in scope usually needs its own inventory entry, impact assessment, life cycle records and monitoring evidence. A handful of low-risk internal tools costs far less to document than a customer-facing system that makes consequential decisions. Ask for a system inventory before quoting and agree in writing which systems receive full assessment and which receive a lighter review.
Third-party and supplier AI
Systems built on a model or service from another company bring supplier questions into scope: contract terms, data flows, documentation received and responsibilities split under the third-party controls in Annex A. Each supplier added to the engagement adds review time. Ask whether the consultant will assess suppliers or only define the process, and list the suppliers you expect to include.
Reusable ISO 27001 and other management systems
An existing ISO/IEC 27001 system already provides document control, internal audit, management review, risk methodology and corrective action processes that ISO 42001 can build on, because both standards use the harmonized structure of clauses 4 to 10. Reuse lowers the cost of the management system core. Ask the consultant to map which existing procedures will be extended and which AI-specific processes must be written new.
Evidence maturity
Consultant effort rises sharply when AI development records, data lineage, model testing results and monitoring logs do not exist or are scattered across tools. Mature teams that already keep versioned records need mostly review and gap closure. Before engaging a consultant, run a short internal check of what evidence exists for each Annex A control and share the result as the starting point for the gap analysis.
Number of locations and environments
Each additional site, cloud account, data center or air-gapped environment where AI systems run adds sampling, interviews and configuration evidence. Consolidating the boundary to a defined set of environments limits this effort. Ask the consultant to list every location in the quote, state how many will be sampled during the readiness review, and confirm which ones the certification body will visit.
Which companion standards reduce consultant effort
ISO/IEC 42001 does not prescribe how to run risk management, life cycle management or data quality management. It lets organizations combine generally accepted frameworks, other International Standards and their own experience. That flexibility is where consultant effort can go up or down: a team that already runs a documented risk process can map it to the standard's requirements, while a team starting from nothing pays for that design work. Before you ask a consultant to build processes from scratch, ask which of these you already have and whether the consultant will reuse them. Two companion standards are most often used for this work. ISO/IEC 23894:2023 gives guidance on AI risk management and is the natural reference for the risk assessment and treatment work that clause 6 of ISO/IEC 42001 requires. ISO/IEC 42005:2025, published in May 2025, covers AI system impact assessment, which maps to the Annex A impact assessment controls. Buying these is optional. Ask your consultant which of them they will use as the working method and whether the deliverables will reference them, since an assessor will look for a consistent, documented method rather than the standard's name.
ISO sells bundles that include ISO/IEC 42001 with a companion. The AI and information security package, combining ISO/IEC 42001:2023 with ISO/IEC 27001:2022, is priced at CHF 340. The responsible AI governance package, combining ISO/IEC 42001:2023 with ISO/IEC 42005:2025, is priced at CHF 365. ISO states that each bundle is a 10% discount on the separate prices. Confirm the current figures on the ISO store before you buy, because prices can change. Before buying a bundle, check three things. First, confirm whether your organization already runs an ISO/IEC 27001 programme, since the bundle only saves money if you need both documents. Second, confirm whether your team or consultant will actually use the companion standard in the work. Third, note that purchasing a standard does not transfer its content into your system. The standards cost little compared with the fees for design, evidence and audit preparation, so the purchase decision should follow the method decision, not lead it.
How an ISO 42001 consultant engagement runs from gap analysis to evidence
The engagement moves from a written scope to a set of documented controls, impact assessments and evidence that the organization owns, then hands a ready system to an independent certification body that makes the certification decision.
Agree written scope and statement of applicability
The organization and the consultant fix the AI systems, business units, locations and suppliers inside the management system boundary, then agree deliverables and timing in writing before work starts. The consultant drafts a statement of applicability under clause 6.1.3 that lists each Annex A control as included or excluded with a justification, and the organization's top management approves it. Done means a signed scope statement and a draft statement of applicability that the organization can defend line by line.
Run gap analysis against clauses 4 to 10
The consultant reviews existing policies, AI inventories, procurement records, engineering practice and governance meetings against the management system requirements in clauses 4 to 10 and the Annex A controls named in the statement of applicability. The output is a gap register that lists each missing or weak element, its owner in the organization, and the evidence that would close it. The organization confirms the register reflects how AI is actually built and used, not only how the policies describe it.
Complete AI system impact assessments
Working with the system owners, the consultant helps prepare the impact assessment process under Annex A.5, including the assessment method, criteria for affected individuals and groups, and records for each in-scope AI system. Risk identification can draw on ISO/IEC 23894:2023 and impact assessment practice can draw on ISO/IEC 42005:2025 where the organization buys that guidance. Done means each in-scope system has a dated assessment record signed by an accountable owner, with open risks linked to treatment decisions.
Build controls and evidence records
The consultant helps design the policies, procedures, technical documentation, data and life cycle records, supplier terms and user information that support the controls the organization has included. Engineers and operators produce the working artifacts, such as model cards, data lineage, change records, access reviews and event logs, and the consultant checks that each control has an owner and a recurring evidence source. Done means every included control maps to a named procedure and a sample of evidence that an assessor could trace without help.
Prepare internal audit and management review
The consultant helps the organization plan and run an internal audit of the management system, usually by a reviewer independent of the work being audited, and prepares the management review agenda required by the standard. Findings are recorded with corrective actions, and the organization decides and minutes the response. Done means completed internal audit records, corrective action logs and management review minutes that show top management actually reviewed the system.
Hand over to the independent certification body
The organization selects a certification body that is accredited for ISO/IEC 42001 and is not the consultant or a body related to the consultant, and then the certification body runs its own stage 1 and stage 2 audits. The consultant's role ends at preparing the system and answering process questions, while the certification body decides the outcome and issues any certificate. Done means the organization holds the certification body's audit plan and quotation, and the consultant has handed over all documentation with a record of what was built and who owns it.
Who owns what: your team, the partner and the certification body
Top management carries the accountability that ISO/IEC 42001 places on the organization's leadership. Leaders set the AI policy direction, approve the scope of the AI management system, make sure resources are available, and decide which AI risks the organization accepts. An implementation partner can draft the paperwork that records these decisions, but it cannot make them, and a certification body will look for evidence that leaders actually made them.
- Policy and scope approval: Leaders approve the AI policy and the boundaries of the AI management system, including which AI systems and business units it covers.
- Risk acceptance: Named owners accept residual AI risks in writing, based on the impact and risk assessments the team prepared.
- Resource decisions: Leaders fund the people, tooling and data needed to run the system after the project ends.
- Management review: Leaders review performance, nonconformities and improvement actions on a set cadence and record the outcome.
- Sign-off on the statement of applicability: Leaders confirm which Annex A controls are included or excluded and why.
Before engaging a partner, confirm in writing which of these decisions your executives will make themselves and which they will only review.
The compliance lead, sometimes called the AI governance lead, runs the management system day to day. This person keeps the document register current, schedules internal audits, tracks corrective actions, and coordinates the teams that produce evidence. In most organizations this role stays in-house after the project closes, because the system only works if someone owns its routine.
- Document control: The lead maintains the AI policy, procedures, records and version history that the system depends on.
- Internal audit: The lead plans and manages internal audits of the AI management system and reports results to leadership.
- Corrective actions: The lead tracks nonconformities from audits, incidents and concern reports until each one is closed with evidence.
- Control evidence: The lead checks that each in-scope control has current, dated evidence before an assessment begins.
- Supplier and vendor follow-up: The lead tracks AI suppliers' documentation and reviews it against the organization's requirements.
Ask any partner whether it will train your compliance lead to run these routines unassisted, and what handover material it will provide.
An implementation partner prepares the systems, documents, tooling and evidence that the organization will use. Its work can include a gap analysis, drafting procedures, setting up logging and records, configuring open-source tools that hold governance evidence, and training staff. The partner works under a written scope and does not own the controls it helps build.
- Gap analysis and planning: The partner compares current practice with the clauses and Annex A controls the organization has chosen to address.
- Document and evidence preparation: The partner drafts templates and structures the records, but the organization reviews, edits and approves every document.
- Tooling and integration: The partner installs and configures systems that store evidence, such as ticketing, logging and document management, inside the client's environment.
- Training and handover: The partner trains staff and documents how to operate the system without outside help.
- Limits of the role: The partner does not issue audit reports or certificates, and it cannot act as the certification body for the same system.
Request a written scope that lists each deliverable and states that the organization approves the final content of its controls.
The certification body is the only party that can issue an ISO/IEC 42001 certificate. ISO does not certify organizations. Certification bodies are independent of the organization and, where accredited, operate under accreditation rules. The certification body reviews the documented system, tests evidence on site or remotely, and makes a certification decision. Its quotation sets the audit days, because ISO's public summary of ISO/IEC 42006:2025 does not describe audit time rules.
- Independent audit: The certification body assesses the system against ISO/IEC 42001 and the organization's statement of applicability.
- Certification decision: The certification body alone decides whether to grant, maintain or withdraw a certificate.
- Impartiality rules: A certification body that gave consultancy to the same client is restricted from certifying that system for a period set by accreditation rules, so check this before hiring a firm.
- Accreditation status: Verify the body's accreditation through the relevant accreditation body and the IAF CertSearch database.
- Quotation: Ask each body for a quote that states its audit days, stages and surveillance plan.
Before signing with any partner, ask the certification body whether it has provided consultancy to you in the past two years.
Why the consultant must stay independent from the certification body
The consultant who helps you build your AI management system should not be the body that certifies it. Certification bodies must stay impartial, and European Accreditation FAQ 33.15 cites ISO/IEC 17021-1 clause 5.2.7 as treating consultancy from a related body as a significant threat to impartiality. One recognized mitigation is that the certification body does not certify that management system for at least two years after the consultancy ends. Before you sign, ask the consultant whether it or any related entity holds certification rights for ISO/IEC 42001, and ask each certification body whether it has provided consultancy to you in the past. A firm that prepares your evidence and a body that issues your certificate should be different organizations.
Independence also shapes what an auditor is allowed to say during an assessment. Clause 5.2.2 of ISO/IEC 27006-1, as explained in European Accreditation FAQ 49.4, lets auditors point out opportunities for improvement but not recommend specific solutions. That means your team must own the design choices in your AI policy, impact assessments and life cycle controls, and the consultant's role is to prepare systems and records, not to tell the auditor how the gaps were closed. Keep a written record of who made each decision, so your internal staff can answer audit questions without relying on the consultant in the room. The same separation applies to readiness reviews: a pre-assessment is useful, but its findings should be treated as your own risk register, not as the auditor's opinion.
Two points are easy to miss. ISO does not certify organizations, and it states that organizations should compare several certification bodies and check their accreditation. Consultants and implementation firms are not accredited to certify unless they are separately accredited certification bodies. Second, ISO/IEC 42006:2025 adds AI-specific requirements on top of ISO/IEC 17021-1 so that certification bodies are competent to assess AI management systems. ISO's public summary does not set audit time rules, so ask each certification body for a quotation that states its audit days and the competence of the assessors it will assign to AI topics.
How to check an ISO 42001 consultant before you sign
A consultant can help you prepare for ISO/IEC 42001, but the organization still owns its controls and the certification body still makes the decision. These checks confirm the firm will not compromise that split, and that you know exactly what you are buying before work starts.
Confirm the firm is not a related body
Ask whether the consultancy belongs to, is owned by, or shares management with the certification body you plan to use. European Accreditation treats consultancy from a related body as a significant threat to impartiality, and a recognized mitigation is that the certification body does not certify that system for at least two years after the consultancy ends. Ask for this answer in writing, with the name of each certification body the firm works with.
Verify the certification body's accreditation
Before you choose a certification body, check that it holds current accreditation for ISO/IEC 42001 certification. Search the body in IAF CertSearch and note the accreditation body, scope and expiry date. Ask the consultant to explain why it recommends that body, and confirm the answer yourself rather than relying on the firm's summary.
Ask for the written scope
Request a written scope that lists the clauses, Annex A controls, business units, AI systems and environments covered. The scope should name which deliverables the firm prepares, such as a gap analysis, impact assessments, policies or a statement of applicability draft, and which items remain with your team. A vague scope is the most common source of unplanned fees later.
Ask what evidence you will receive
Ask for a list of every artifact the firm will hand over, with its format and owner: policies, risk registers, impact assessment records, supplier reviews, training logs and internal audit reports. Confirm that the files are delivered to your repositories and remain usable after the engagement ends. You should be able to show each item to an assessor without the consultant present.
Check how the independence rule is handled
Ask how the firm separates its preparation work from any certification or audit role. A consultant may point out gaps and explain requirements, but it should not design a solution for the auditor to approve, nor should it act as the auditor for your system. Ask for the firm's written independence policy and who on its team is excluded from certification-related work.
Confirm the work is fixed-scope
Ask whether the engagement is priced as a fixed-scope project with agreed deliverables and timelines, or as open-ended time and materials. Ask what triggers a change order, how many review cycles are included, and whether ongoing support is a separate retainer. Fixed scope lets you compare quotes on the same basis.
Questions buyers ask about ISO 42001 consultants and cost
Can we do ISO 42001 without a consultant?
Yes. ISO/IEC 42001 is a standard your organization can implement with its own staff, and nothing in it requires an outside firm. The organization owns its AI management system, its policies, its risk and impact assessments and its internal audit. Many teams choose a consultant because they lack people who know the clauses, the Annex A controls and the evidence an assessor will ask for, or because they need the work done faster than their own staff can absorb it. A useful test is whether your team can write the statement of applicability, run an AI impact assessment and hold a management review without help. If not, a fixed-scope engagement can cover those gaps while your people keep decision rights. The standard itself costs CHF 225 in PDF or ePub form, according to ISO's store as of October 2026, and companion guidance such as ISO/IEC 23894:2023 is optional.
What does an ISO 42001 consultant cost?
A consultant's fee follows from a written scope, not from a published rate card. DeployOpen does not publish a price list; a quote follows from the agreed scope, deliverables and timeline. The main cost drivers are the number of AI systems in scope, how many business units and suppliers are involved, how mature your existing management system is, and whether you already run ISO 27001 that can be extended. Ask each provider to split the quote into one-time items, such as gap analysis, policy drafting, impact assessments and control implementation, and recurring items, such as surveillance support or management review facilitation. Separately, the certification body's audit fee is a different cost paid to a different party. Standard purchase costs are also distinct: ISO sells ISO/IEC 42001:2023 at CHF 225, and the ISO package with ISO/IEC 27001:2022 costs CHF 340.
How long does ISO 42001 consulting take?
The duration depends on scope and is set in the quote, so no fixed timeline applies to every organization. Work runs longer when many AI systems need impact assessments, when data governance and supplier controls are immature, or when internal decision-makers are slow to approve policies. It runs shorter when an existing ISO 27001 system provides documented information, risk processes and internal audit that can be extended. Before you sign, ask for a phased plan with named milestones, a list of the dependencies on your team, and the point at which the certification body's stage 1 and stage 2 audits fall. Those audits are scheduled by the certification body, which may have its own lead times, so confirm them separately.
What does the consulting work need from our team?
Consulting outputs only become evidence when your people own the decisions behind them. Expect to commit named owners for top management duties, the AI policy, the AI system inventory and the impact assessments, because the organization must own its controls. Your team will need to supply system documentation, data sources, model and supplier details, incident history and access to the people who build and operate each AI system. Expect them to review drafts, approve the statement of applicability, attend management review and run the concern reporting channel after the engagement ends. Ask the provider to list these inputs by role and hours per week in the written scope, so the work can be planned against existing commitments.
Can a consultant certify us to ISO 42001?
No. ISO does not certify organizations, and certification is issued by an external certification body. A consultant or implementation firm can prepare your systems, controls and evidence, but it cannot issue a certificate unless it is separately accredited as a certification body for that scope. ISO advises organizations to compare several certification bodies and check their accreditation before choosing one. Verify any certificate issuer through the IAF CertSearch database, which lists certificates issued by accredited bodies. Be cautious of any firm that promises certification as part of consulting, because the certification decision must come from an independent body.
Can one firm both prepare us and certify us?
Generally no, because of independence rules. Under ISO/IEC 17021-1 clause 5.2.7, as explained by European Accreditation FAQ 33.15, consultancy from a body related to the certification body is a significant threat to impartiality. A recognized mitigation is that the certification body does not certify that management system for at least two years after the consultancy ends. Accreditation bodies treat this as a conflict of interest, so the firm that designed your controls should not also issue your certificate. Ask any consultant whether it has any relationship with the certification bodies you are considering, and get that answer in writing before you contract.
Which companion standards reduce consulting effort?
Two companion documents often shorten the work. ISO/IEC 23894:2023 gives AI risk management guidance that can structure your risk process, and ISO/IEC 42005:2025 covers AI system impact assessment, which maps directly to Annex A controls on impact assessment. ISO/IEC 42005:2025 has 39 pages and ISO sells it with ISO/IEC 42001:2023 as a responsible AI governance package for CHF 365, a 10% discount on the separate prices. Existing ISO/IEC 27001 processes, such as risk assessment under ISO/IEC 27005:2022, can also be reused where they fit. Buy these only if your scope needs them. Ask your provider which companion guidance it expects to use and whether it has already been reflected in the quote.
How DeployOpen scopes and prepares ISO 42001 evidence
DeployOpen works as an implementation partner on ISO 42001 readiness: we prepare the systems, controls and evidence that your organization owns and that an independent certification body will assess. We do not issue reports or certificates, and we do not certify the systems we helped build.
How we scope
- Engagements are fixed-scope, with the systems, Annex A controls and deliverables agreed in writing before work starts.
- The written scope states which AI systems, business units and suppliers are included, and which evidence each item will produce.
- Ask for the scope to name who owns each control, so accountability stays with your organization and is not handed to us.
How we build
- We implement and document the technical and operational controls in your own cloud accounts, data centers or air-gapped networks.
- Open-source platforms are configured to keep evidence such as access records, change history, logs and risk register entries.
- Testing, including AI and agent security testing where it is in scope, produces records that feed the statement of applicability and assessment files.
How we hand over
- You receive the documentation, configuration records and evidence index as deliverables, written so your staff can maintain them.
- Work is handed over to your internal owners with a walkthrough of how each control is operated and evidenced.
- We do not decide applicability or sign off conformity: your management and the certification body make those determinations.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
- A retainer can cover evidence refreshes ahead of surveillance or recertification audits, as agreed in writing.
- Before engaging, confirm with us and with any certification body that the scope of our work will not create an impartiality conflict.
