All services Every engagement has a fixed, published price. Book a strategy call
What ISO/IEC 42001 requires, what a certificate proves and what it does not, how it compares with ISO 27001 and the EU AI Act, and a six question test.
ISO/IEC 42001 is the international standard for an AI management system. That sentence is accurate and tells most people almost nothing useful. What buyers want to know is what the standard makes them build, whether a certificate would win or protect any business, and whether the money would be better spent elsewhere.
This guide answers those questions in plain terms. It explains what an AI management system is, how the standard is structured, how it differs from ISO 27001 and from the EU AI Act, a short test for whether you need it, and what implementation costs and takes. Intelance implements AI management systems, so weigh the recommendations accordingly. The test below is written to give an honest answer including when the answer is no.
The short answer. ISO/IEC 42001 is a management system standard, so it certifies how you govern AI rather than whether any individual model is safe. It gives you an AI inventory, risk assessment, impact assessment, named ownership, supplier controls and an audit cycle. You probably need it if customers or regulators are asking for proof, if AI is central to what you sell, or if you already hold ISO 27001 and want the same discipline over AI. You probably do not need it yet if you have no AI inventory, because that comes first. Implementation commonly runs three to six months, with build programmes from £30,000 + VAT and certification body fees on top.
A management system is machinery for making and evidencing decisions. Applied to AI, ISO/IEC 42001 asks you to build six working parts and then prove they run.
The standard itself follows the same structure as other ISO management systems. Clauses four to ten cover context, leadership, planning, support, operation, performance evaluation and improvement. Annex A carries the AI specific controls, and Annex B explains how to implement them. If you have been through ISO 27001, the shape will be immediately familiar.
Being precise here saves money, because most disappointment with certification comes from expecting the wrong thing.
| What ISO/IEC 42001 does | What it does not do |
|---|---|
| Proves you have a governed process for adopting and running AI, verified by an independent auditor | Prove that any particular model is accurate, fair or safe. That needs system level testing |
| Gives procurement and enterprise customers a recognised answer to their AI questions | Satisfy a legal obligation on its own. Regulators ask about outcomes rather than certificates |
| Forces an inventory and named ownership, which is where most of the real risk reduction happens | Replace the technical evaluation of high risk systems before they go live |
| Creates an evidence trail a board, insurer or acquirer can rely on | Cover data quality problems underneath the AI. That is a data governance job |
The last row matters more than it looks. An AI management system built on unowned, unmeasured data certifies the process and inherits the problem. Our guide to why data governance is the foundation of safe AI explains that dependency, and how to implement data governance sets out the groundwork.
These three get confused constantly, and the confusion leads organisations to buy the wrong thing.
| What it is | ISO/IEC 42001 | ISO/IEC 27001 | EU AI Act |
|---|---|---|---|
| Nature | Voluntary standard you can certify against | Voluntary standard you can certify against | Law with dates and penalties |
| Concern | How AI is governed across its lifecycle | How information is kept secure | Whether specific AI uses are permitted and on what conditions |
| Who asks for it | Customers, procurement teams, boards and investors | Enterprise procurement, almost universally | Regulators, and customers inside scope |
| What you get | An accredited certificate covering the management system | An accredited certificate covering the defined scope | No certificate. Compliance is demonstrated through evidence |
Holding ISO/IEC 42001 does not make you compliant with the EU AI Act, and saying so to a regulator would go badly. The relationship is more useful than that. The management system is the machinery that produces the evidence the law asks for. Our guides to what the EU AI Act means for UK companies and how the Act and the standard fit together architecturally cover that in detail. For a framework rather than a certificate, the NIST AI Risk Management Framework is the common alternative reference, and it carries no certification.
Three or more clear yes answers, particularly to the first three, usually means certification earns its cost. A no to question five outranks everything else. Our guide to AI governance covers the groundwork, and if the deciding factor is budget, AI governance cost in the UK sets out what the components cost separately.
For a UK organisation of moderate size, a first AI management system commonly takes three to six months. Holding ISO 27001 shortens it because the shared clauses already exist.
| Stage | What happens | What exists at the end |
|---|---|---|
| Inventory and scope | Find every AI system in use, including supplier features, and decide what the system covers | A register with owners, and a defensible scope statement |
| Risk and impact | Assess AI risk and the effects on people, then decide which Annex A controls apply | Assessments on record and a documented set of applicable controls |
| Build | Policy, objectives, intake and approval route, supplier expectations, lifecycle controls | Machinery people use, generating evidence as it runs |
| Operate | Run the cycle long enough to produce records. Internal audit and management review | Several months of evidence, which is what an auditor examines |
| Certify | Stage one document review, then stage two audit by an accredited certification body | A certificate, and findings to close |
Choose a certification body accredited by a recognised national body such as UKAS in the UK. An unaccredited certificate can be challenged by the customers you bought it to satisfy. The same logic governs ISO 27001, and our ISO 27001 certification process guide walks the stages in more detail, since the mechanics are nearly identical.
Three separate costs sit behind any certificate, and providers who quote one number are hiding two of them.
The full engagement detail sits on our ISO/IEC 42001 implementation page, and the wider practice on the AI governance hub. Where the requirement is independent verification rather than a build, an AI governance audit examines what already exists.
It is the international standard for an artificial intelligence management system. It sets out how an organisation should govern its use and development of AI across the lifecycle, covering inventory, risk and impact assessment, ownership, supplier expectations, internal audit and management review. Organisations can be certified against it by an accredited certification body.
No. The Act is law with specific obligations by date, and the standard is a voluntary management system. Certification produces much of the evidence the Act requires, which makes compliance easier to demonstrate, but holding a certificate is not a defence on its own.
Commonly three to six months for a first system in a UK organisation of moderate size, plus the audit cycle. Organisations already certified to ISO 27001 move faster because the shared management clauses already exist and only the AI specific parts are new.
Three costs apply. Building the system, which with Intelance starts from £30,000 + VAT. Certification body audit fees, paid separately to the auditor. Running the system afterwards, which can be internal or bought as a service from £8,000 + VAT per month.
No, although holding it helps considerably. The two standards share the same management clauses, so an existing ISMS reduces both the work and the cost. Where neither exists and information security is also being asked about, most organisations sequence ISO 27001 first.
Leadership owns the policy and objectives, a named individual owns each AI system in the register, and one person coordinates the machinery. The standard expects accountability at top management level, and auditors test whether that accountability is real by asking the people named.
Yes. The standard scales with the size of the organisation and the AI estate, and a small company with a narrow scope can hold a meaningful certificate. The practical constraint is usually having somebody able to run the cycle after certification rather than the build itself.
Often not yet. If no customer, regulator or investor is asking and no commercial outcome is blocked, the same budget spent on an accurate AI inventory and a working approval route reduces more risk. Certification becomes worthwhile once somebody with money or authority wants proof.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
