A customer asked for ISO 42001: what to do first
When a contract or RFP names ISO/IEC 42001, the first thing to remember is that only an independent, accredited certification body issues an ISO 42001 certificate. ISO does not certify organizations, and no implementation partner, consultant or internal team can issue one. The right response depends on the exact wording of the requirement, the deadline, and whether the buyer will accept an accredited certificate, a self-assessment or a certificate held by a provider. Accreditation of certification bodies is voluntary, so a certificate's value depends on who issued it. As of Global ACI-FMRA-001 version 3.3, ISO/IEC 42001 is not listed as an endorsed sub-scope of the Global ACI recognition arrangement, so confirm with the accreditation body whether the bodies you are considering are accredited for this standard before you rely on their certificate.
Respond in three steps. First, clarify the requirement in writing. Ask the buyer whether they require a certificate, a statement of applicability, an attestation or only evidence of an AI governance program, and whether the certificate must come from an accredited body. Ask which scope they mean, since a certificate covering one AI product may not satisfy a request about the whole company. Second, verify what can be verified. Check any certificate a vendor or cloud provider offers against the issuing body's accreditation, using ISO's certification guidance as a starting point and confirming status in IAF CertSearch. Third, plan the route. Decide between a certification project, interim evidence such as a CSA STAR for AI self-assessment, or a written commitment with a dated plan, and tell the buyer which one you are taking and why.
How the ISO 42001 certification process runs
The certification sequence moves from scoping and readiness through a period of operated management system records, a stage 1 document review, a stage 2 implementation audit, and a certification decision made by an independent body. Each step leaves a specific output that the next step depends on.
Define scope and the statement of applicability
The organization sets the boundary of its AI management system: which products, AI systems, teams and sites are covered, and which Annex A controls are necessary. Clause 6.1.3 requires a statement of applicability that lists the controls and justifies including or excluding each one, so the justifications need to be written by people who understand the AI systems involved. Ask the certification body early whether it has reviewed the proposed scope. The step is done when the scope statement and a draft statement of applicability exist and leadership has approved them.
Run a readiness review and close gaps
Compare the existing AI policies, risk and impact assessments, supplier records, documented information and roles against clauses 4 to 10 and the chosen Annex A controls. The organization owns the gap list and decides the fixes, while an implementation partner, if one is used, can prepare documents, technical evidence and system configuration. This is also the point to confirm with the certification body what it expects in documented information. The output is a gap register with an owner and a due date for each item.
Operate the management system until records exist
Before a certification audit, the system must be running its performance evaluation clauses: monitoring, measurement, analysis and evaluation under 9.1, internal audit under 9.2, and management review under 9.3, with nonconformity and corrective action under 10.2. An auditor needs to see these activities happen, not only be planned. Ask the certification body how much operating history it expects before stage 2, because that expectation drives the schedule. The output is a set of dated records: monitoring results, internal audit reports, management review minutes and corrective action logs.
Complete the internal audit and management review
The organization runs an internal audit of the management system against its own requirements and then holds a management review that considers audit results, AI risks, objectives and resources. The internal audit should be performed by people independent of the work they examine. Findings are recorded as nonconformities or observations, and each nonconformity gets a corrective action with a root cause and a closure check. The step is complete when the internal audit report and the management review minutes show decisions, not just attendance.
Pass the stage 1 documentation review
The certification body reviews the documented management system and the statement of applicability and checks whether the organization is ready for the on-site or remote implementation audit. Under ISO/IEC 17021-1, the initial audit is one audit in two stages, and the stage 1 plan may be informal, though both stages need an audit plan. The stage 1 review produces findings that must be resolved before stage 2 can proceed. Ask the body for its stage 1 report format and how gaps identified there are tracked. The output is the stage 1 findings and a stage 2 plan, sometimes with a required lead time agreed in advance.
Demonstrate implementation in the stage 2 audit
The stage 2 audit tests whether the management system works in practice. Auditors sample AI systems, impact assessments, data records, supplier reviews, use controls and records from the performance evaluation clauses, and they interview the people who operate them. The organization provides access and staff time, and any internal or partner advisers attend only as observers. Findings are classified, and nonconformities must be corrected and verified. The output is the stage 2 audit report with its nonconformity records.
Resolve nonconformities and receive the certification decision
The organization submits corrective action evidence for any nonconformities raised in stage 2. The certification body reviews that evidence and makes the certification decision independently of the consultants and implementation partners who helped prepare the system. The certificate and its scope statement are issued by the body, not by the organization or its advisers. Confirm with the body the exact certificate wording, its validity period, and the surveillance schedule that follows, since those define the ongoing obligations. The output is the issued certificate, which buyers can check through the public registers described on this page.
How to verify an ISO 42001 certificate before signing
A certificate is only useful if it is issued by an accredited certification body, is still valid, and covers the service the contract describes. The checks below let a buyer or reader confirm each point independently, without relying on a copy supplied by the vendor.
Confirm the certification body's accreditation
Accreditation is voluntary, so a certification body can exist without it. Ask which accreditation body accredited the certification body for ISO/IEC 42001, then confirm that status directly with that national accreditation body or in IAF CertSearch. A mismatch means the certificate may not carry the recognition the contract expects, and the buyer should ask for an explanation in writing before relying on it. Accreditation is not a guarantee of quality, but it is the simplest objective test available.
Verify the certificate's current status
Look up the certificate in IAF CertSearch by certificate number and certified organization name. ISO notes that status can be checked one at a time, in bulk, through an API, or by contacting the certification body or accreditation body directly. A certificate that is suspended, withdrawn or not found is a serious mismatch, and the buyer should not accept a PDF copy in place of a live status check.
Match the certificate scope to the contract
The certificate lists the organization, the scope of its AI management system and sometimes specific products or services. Compare that wording against the product named in the contract, including any AI features, model vendors and hosting arrangements that the customer will rely on. If the certificate covers only a corporate function or a different product line, the customer is buying an AI governance commitment the certificate does not support, and the contract should name the in-scope service explicitly.
Check validity dates with the certification body
Confirm the issue date, expiry date and the timing of surveillance audits with the certification body, not only from the document the vendor sends. A certificate that is near expiry, or whose surveillance audit is overdue, may be renewed on a different timeline than the contract assumes. Ask the vendor for the next audit date and for any nonconformities that remain open, because these affect whether the certificate will still be valid during the contract term.
Interim evidence while certification is in progress
A customer may accept interim evidence while your ISO/IEC 42001 certification is still in progress, but only if the buyer agrees to it in writing. The most common option is CSA STAR for AI. Level 1 is an AI-CAIQ self-assessment, built on the AI Controls Matrix (AICM), the AI-CAIQ questionnaire and ISO/IEC 42001. Your organization completes and publishes the answers itself. Since 20 November 2025, a validated AI-CAIQ combined with ISO/IEC 42001 certification achieves STAR for AI Level 2, so the certificate is the step that moves the evidence up a level. Confirm the current program rules on the Cloud Security Alliance STAR page before you commit to a level in a contract response.
A self-assessment is not a certificate. It shows that you have answered the questions honestly and in detail, but no independent certification body has tested your management system against the standard. Ask the buyer directly whether a Level 1 self-assessment, a timeline for certification, or both will satisfy the clause. Some buyers will accept a dated plan with an accredited certification body engaged. Others will not, and you should learn that before the contract is signed rather than during renewal.
Buyers often also ask to see two working documents: your AI policy and your statement of applicability. The AI policy shows management direction for AI, and the statement of applicability, required by clause 6.1.3, lists each Annex A control you include or exclude and the reason. Prepare both early, because they are the clearest evidence of what your program covers. Neither document replaces certification, and you should not describe them as a certificate or imply that an auditor has reviewed them. Make sure the statement of applicability matches what your team actually operates, since a buyer who asks follow-up questions will test that match.
What certified cloud providers cover and what they do not
If your organization buys cloud services and a customer or regulator asks about the AI governance behind them, the provider's certificate is a useful starting point. AWS holds an ISO/IEC 42001:2023 certification that Schellman Compliance, LLC verifies. Schellman is an ISO certification body accredited by the ANSI National Accreditation Board (ANAB). You obtain the certificate yourself by downloading it through AWS Artifact, where it lists the in-scope services. Confirm the certificate's status with the certification body or in IAF CertSearch before you cite it in a questionnaire.
- Verify the certifying body: Check that Schellman's accreditation covers ISO/IEC 42001 and that the certificate is current.
- Read the scope list: The certificate names the in-scope services. A service missing from that list is not covered, however widely it is used.
- Note the date and version: Keep a dated copy of the certificate in your evidence store, since certificates change at each surveillance or recertification cycle.
- Separate provider duties from yours: The provider's certificate describes its own management system, not how your team selects, tests or monitors its services.
- Ask for the statement of applicability if needed: Where a customer asks which controls apply, ask the provider what it has shared under its agreement.
Before relying on the certificate, compare its in-scope services with the exact services your AI workload uses.
If your SaaS product runs AI features on a certified cloud, the provider's certificate covers the infrastructure layer that you rent. It does not transfer to your product. Your customers will ask about your own AI system, its data, your policies and your human oversight, and none of these come from the provider's audit. Your organization still needs its own AI management system, risk and impact assessments, and supplier controls for the cloud and for any model vendor you use.
- Your AI system stays in your scope: Prompts, training or fine-tuning data, output handling and product-level safeguards are your responsibility.
- Your data and policies stay in your scope: The provider does not write your AI policy, assess your impacts or define your roles.
- Your controls stay in your scope: Monitoring, incident handling and user information for your AI features need evidence from your own operations.
- Shared responsibility needs a written map: Document which controls the provider performs, which you configure and which you run, so auditors can trace each one.
- Model vendors need separate review: A cloud certificate does not cover a third-party model unless that model is named in the cloud provider's scope.
(Illustrative) A SaaS team that cites the cloud certificate in a questionnaire but cannot show its own AI risk assessment will usually face follow-up questions.
The most common mistake is assuming that a certificate covers everything an organization runs in a provider's account. Scope is defined by the services and, in some cases, the regions or environments named on the certificate. Before you accept a certificate as evidence, compare its scope with your own service inventory. Treat any gap as a control you must evidence yourself or justify as out of scope in your statement of applicability.
- Build a service inventory: List every cloud service your AI workload calls, including storage, managed model endpoints, logging and vector databases.
- Match each service to the scope list: Mark services as covered, not covered or unclear.
- Resolve unclear items with the provider: Ask in writing which service, region and version the certificate applies to.
- Record exclusions with reasons: A service you use but the certificate omits needs its own evidence or a documented justification.
- Repeat the check at each renewal: Scope changes over time, so review the certificate whenever the provider issues a new one.
Confirm the certificate's scope against your architecture before you describe the provider's coverage to a customer.
Who owns what when a customer requires ISO 42001
A customer requirement for ISO 42001 touches three parties with different jobs. The organization decides and runs its AI management system, an implementation partner prepares systems and evidence, and an independent certification body audits and issues the certificate. Keeping these roles separate is what makes the eventual certificate worth trusting.
The organization owns the system
Your organization owns the AI management system, its scope, its AI policy, its risk decisions and the controls it chooses to include or exclude. Those decisions must be made by your own leadership and documented in the statement of applicability, which clause 6.1.3 requires you to justify control by control. A partner can draft options, but it cannot accept risk or sign off on exclusions for you. Ask who on your side is accountable for each of those decisions before work starts.
The partner prepares systems and evidence
An implementation partner such as DeployOpen can help configure self-hosted platforms, build records, set up logging, and prepare documentation and evidence for the controls you have chosen. Its work product is material for your team and your auditor. It does not issue audit reports, attestations or certificates, and it does not approve your controls. Confirm in the written scope exactly which artifacts the partner will deliver and who keeps ownership of them.
The certification body audits and certifies
Only an external certification body accredited for this scope can perform the two-stage audit and issue an ISO/IEC 42001 certificate. ISO does not certify organizations, and accreditation of certification bodies is voluntary. Check that the body is accredited for ISO/IEC 42001 specifically, not just for management systems in general, before you rely on its certificate. Ask the body how it has applied the additional requirements for AI management system certification.
Independence between partner and auditor
A partner that helped build the system cannot also be the certifying body for the same engagement, because the auditor must assess the system independently of the people who designed it. Your partner and your auditor should be separate firms with separate contracts. Ask any candidate partner whether it has any relationship with the certification bodies you are considering, and get that answer in writing.
Written boundaries in the contract
Put the roles in the contract. Your scope statement should name the AI systems in scope, the deliverables the partner will produce, the decisions that stay with your organization, and the evidence your auditor will receive. Set out who pays the certification body, who maintains records after the engagement ends, and how ongoing surveillance will be handled. Clear written boundaries prevent a common gap where everyone assumes someone else owns the evidence.
How long it takes and what drives the cost
The cost of ISO 42001 certification is spread across three payees, and only one of them issues the certificate. The certification body is paid for the initial certification audit, which under ISO/IEC 17021-1 runs as one audit in two stages, and for the certificate itself. A consultant or implementation partner, if you hire one, is paid to prepare the management system, the statement of applicability and the evidence. Your own organization carries staff time from engineering, product, legal and risk, plus any tooling used to keep records, logs and reviews. Preparation work is largely one-time, while surveillance audits and recertification recur over the life of the certificate. Ask the certification body to state its fee structure in writing, including whether surveillance and recertification are priced separately from the initial audit.
Four drivers move the size of the bill and the calendar more than anything else. The first is scope: the number and type of AI systems you include, and whether you are provider, user or both for each one. The second is the number of sites and business units that operate those systems. The third is reliance on third parties, such as foundation model vendors, data suppliers and cloud platforms, because each supplier relationship needs controls and evidence under the A.10 objectives. The fourth is evidence maturity. An organization that already runs documented risk assessments, internal audits and management reviews usually needs less preparation than one building those records for the first time. Note that the performance evaluation and corrective action clauses must be operating before the audit, so the calendar depends on how long those cycles take to produce results.
When you request a quote, ask for a written timeline with dated milestones for the stage 1 review, the stage 2 audit and any remediation window. Ask for the audit plan for each stage, and for the certification body's confirmation of the scope it will accept, since scope changes after the quote can reprice the engagement. If a consultant is involved, require a fixed-scope statement of work that lists deliverables, what the consultant will not do, and who owns each control. Confirm with the certification body whether its ISO/IEC 42006 requirements apply to its AI audit process and how it charges for surveillance. Any figure you receive should be traceable to the scope you defined, not to a generic package.
What delays the project or misleads the buyer
Most delays on an ISO 42001 request come from a small set of avoidable mistakes: trusting a certificate without reading it, borrowing a provider's certificate for your own system, or rushing certification before records exist. Each card names one pitfall and the check that prevents it.
Accepting a certificate without checking accreditation
A certificate is only as useful as the body that issued it. ISO explains that accreditation of certification bodies is voluntary and that an unaccredited body is not necessarily disreputable, but a customer's procurement team still needs to know which kind it received. Ask for the certification body's name, then confirm its accredited status with the national accreditation body or in IAF CertSearch, where anyone can look up a certificate's status. Check the certificate's validity dates and scope at the same time.
Confusing the certificate's scope
A certificate covers the services or systems named in its scope statement, not the vendor's whole business. Certificates are often read as covering a product that was never in the audit. Before relying on one, compare the scope wording with the product, the AI system and the operating locations your customer cares about. If the scope names a platform but not the customer-facing feature built on it, the gap is yours to close and document, and your customer should expect to see that gap stated in writing.
Borrowing a cloud provider's certificate
A cloud provider's ISO/IEC 42001 certificate covers the provider's own AI management system and the in-scope services listed on the certificate. It does not certify the AI system you build on top of those services, your training data, your prompts, your user-facing features or your own controls. AWS publishes its certificate through AWS Artifact, which lists the in-scope services. Use it as supplier evidence under your A.10 supplier controls, and document where your own responsibilities begin.
Promising certification before records exist
Certification assumes the management system has been running, not just written. Before a certification audit, clauses 9.1 (monitoring, measurement, analysis and evaluation), 9.2 (internal audit) and 9.3 (management review) must have produced actual records, and clause 10.2 requires nonconformities to be handled through corrective action. A project plan that puts certification in a fixed early window often skips this operating period. Ask your certification body and consultant to show the records they expect to see, and plan for the management system to run long enough to generate them.
Excluding Annex A controls without justification
Not every Annex A control must be implemented, but clause 6.1.3 requires a statement of applicability that lists the necessary controls and justifies including or excluding each one. Customers and auditors read this document closely. Exclusions with no reason, or exclusions of controls that cover a feature you actually ship, such as A.6 life cycle controls for a model you fine-tune, create the most visible questions in a review. Write each exclusion with a reason tied to your AI systems and roles before you send the statement to a customer.
Treating a self-assessment as certification
A CSA STAR for AI Level 1 result comes from an AI-CAIQ self-assessment. It is useful interim evidence for a questionnaire, but it is not ISO/IEC 42001 certification and should not be described as one. Since 20 November 2025, a validated AI-CAIQ combined with ISO/IEC 42001 certification achieves STAR for AI Level 2, so the certification step is still what changes the claim. Tell the customer which level you hold, what it was based on and who validated it, and avoid wording that implies an independent audit occurred when it did not.
Questions buyers ask when a customer requires ISO 42001
Is an ISO 42001 certificate accredited today?
Some certificates are, but accreditation for ISO/IEC 42001 is still developing, so confirm it for each certificate you receive. ISO does not certify organizations; external certification bodies do, and their accreditation is voluntary. As of the Global ACI-FMRA-001 version 3.3 listing dated August 2026, ISO/IEC 42001 is not listed as an endorsed sub-scope of the Global ACI recognition arrangement, unlike ISO/IEC 27001 with ISO/IEC 27006-1. Ask the certification body which accreditation body granted its scope for ISO/IEC 42001 and whether that scope references ISO/IEC 42006:2025, which sets additional requirements for bodies certifying AI management systems. A certificate from a non-accredited body is not necessarily disreputable, but your customer's procurement team should decide whether it meets their requirement.
How do I check whether an ISO 42001 certificate is valid?
Check the certificate's status in IAF CertSearch, which ISO points to for verifying certification status. You can search one certificate at a time, run bulk checks or use the API, or contact the certification body or the accreditation body directly. Confirm four things: the certificate number, the issuing body, the scope statement and the expiry or next surveillance date. Make sure the scope names the AI systems and products your customer is buying, not only a general statement about the organization. Save the verification date and result in your vendor file, because a certificate can be suspended or withdrawn after it is issued. Ask your supplier for the certificate and its scope in writing, then verify it yourself rather than relying on a copy in a sales deck.
Is a CSA STAR for AI self-assessment enough for a customer?
A self-assessment is useful interim evidence but it is not a certification. CSA's STAR for AI program builds on the AI Controls Matrix, the AI-CAIQ questionnaire and ISO/IEC 42001. Level 1 is an AI-CAIQ self-assessment. Since 20 November 2025, a validated AI-CAIQ combined with ISO/IEC 42001 certification achieves STAR for AI Level 2. Level 1 shows the organization has answered a structured set of AI governance questions, but the organization owns those answers. Ask your customer whether a self-assessment satisfies the clause in the contract, and whether they accept a Level 2 result or require an accredited ISO certificate. Review the CSA STAR certification levels page before you commit to a level.
Does a cloud provider's ISO 42001 certificate cover my product?
Usually only the provider's own in-scope services, not the AI features you build on top of them. AWS states that its ISO/IEC 42001:2023 certification was verified by Schellman Compliance, LLC, an ISO certification body accredited by ANAB, and customers can download the certificate, which lists in-scope services, through AWS Artifact. Read the scope list line by line. A provider certificate can support your supplier review and show the controls under the infrastructure layer, but your application, prompts, training data, user-facing documentation, incident handling and impact assessments remain your responsibility. Confirm with the provider which services and regions are covered and which responsibilities they expect you to take under the shared model.
How long does ISO 42001 certification take and what does the team need to provide?
The timeline depends on how far your AI management system already runs, not on the standard alone. Under ISO/IEC 17021-1, the initial certification audit is one audit in two stages, and both stages need an audit plan, though the stage 1 plan may be informal. Before the certification audit, your management system must already operate the performance evaluation clauses: monitoring and measurement (9.1), internal audit (9.2), management review (9.3), and nonconformity and corrective action (10.2). Your team will need a named AI governance owner, an AI policy, an AI inventory, risk and impact assessment records, supplier records and evidence that these processes ran for a period. Ask any certification body for a written quote that lists stage 1, stage 2, surveillance and recertification, and the staff time you are expected to provide.
Can we prepare for ISO 42001 ourselves or do we need outside help?
Your organization can do the work itself if it has people with the time, authority and skills to own AI governance. The organization owns its controls, policies, risk decisions and evidence, and the certification body alone issues the certificate. An implementation partner can prepare systems, documentation and evidence, but it cannot audit your system or sign off the result. Internal staff typically need to cover the AI inventory, the statement of applicability with justified exclusions, impact assessments, supplier reviews and internal audit. Outside help is most useful when no one has run an management system before or the team lacks time. Ask any consultant for a written, fixed scope with named deliverables, and confirm that it is independent of the certification body you plan to use.
What does an ISO 42001 engagement cost and what drives the price?
Cost depends on scope, the size of the AI estate, how mature your existing controls are and who you pay for each part. Four cost components matter: certification body fees for the audits, surveillance and recertification, internal staff time, any outside implementation support, and tooling used to keep evidence. Audit fees are recurring over the certification cycle, while policy writing, gap analysis and system setup are usually one-time. Costs rise with the number of AI systems in scope, the number of sites, the number of third-party models you rely on and any gaps in logging or data records. Ask each supplier for a written quote that names the scope, deliverables, exclusions and the recurring items. DeployOpen does not publish a price list; a quote follows from a written scope.
How DeployOpen prepares your team for an ISO 42001 audit
DeployOpen works on the systems, controls and evidence behind an ISO 42001 audit, not the audit itself. We scope the work in writing, build and document the AI management system with your team, and hand over evidence your organization owns. An independent certification body makes the certification decision.
How we scope
- We agree a written, fixed scope covering the AI systems, products and teams that the customer request relates to.
- The scope lists which Annex A controls apply, with the statement of applicability reviewed with your own owners.
- Deliverables, timelines and responsibilities are confirmed in writing before any implementation work starts.
How we build
- We help set up the clause 4 to 10 management system records, including the AI policy, roles and the risk and impact assessment process.
- We configure self-hosted open-source tooling inside your own cloud accounts or data centers to keep governance evidence.
- We run internal audit and management review preparation so clauses 9.1 to 9.3 and 10.2 operate before the certification audit.
How we hand over
- You receive the documented management system, evidence index and configuration records in your own repositories.
- Your staff are trained to maintain the records, so ownership of AI governance stays inside your organization.
- We walk your team through what an auditor is likely to sample, and what to confirm with your chosen certification body.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after handover.
- Support can cover surveillance audit preparation, changes to AI systems and updates to the statement of applicability.
- Any questions about certification timing, accreditation or certificate verification go to the certification body and its accreditation body.
