ISO 42001 certification in the UK: UKAS accreditation, UK GDPR and what your customers check

Why UK organisations pursue ISO/IEC 42001 certification

In the United Kingdom the request usually arrives through a customer's due diligence. A bank, insurer, public body or large enterprise buying an AI-enabled service wants to know who owns each model, how its risks were judged and what happens when it goes wrong. An accredited ISO/IEC 42001 certificate answers those questions in one document that a procurement team can look up, rather than in a new questionnaire for every client.

The second driver is the move from a responsible-AI statement to evidence. Boards of UK software companies, BPO operators and professional firms that already hold ISO/IEC 27001 see the AI management system as the natural next layer: the same audit discipline, applied to the models, data and decisions their ISMS was never written to cover. The ISMS extension guide shows how that works without building a second system.

Certification itself is voluntary. No UK law named in our research requires ISO/IEC 42001, so the case rests on your customers and your own risk appetite; the decision guide helps you test it.

UKAS accreditation for ISO/IEC 42001 in the UK

UKAS is the national accreditation body for the United Kingdom, appointed by government to assess organisations that provide certification, testing, inspection and calibration. It accredits certification bodies; it does not certify your organisation, and it will not comment on a body it has not accredited.

For this standard, UKAS ran a development programme for AI management systems. Its programme page describes the pilot as concluded and applications as open, with accreditation assessed against ISO/IEC 17021-1 and the additional requirements of ISO/IEC 42006:2025. UKAS announced its first ISO/IEC 42001 accreditation of a certification body in January 2026. Accredited certification for this standard is newer than for ISO 9001 or ISO/IEC 27001, so not every body offering AI certification will hold it. Ask each quoting body for its schedule and look for ISO/IEC 42001 by name.

On international recognition, UKAS signs the European co-operation for Accreditation agreement and states that its accreditations remain recognised under the Global ACI arrangement, which replaced the IAF and ILAC arrangements from 1 January 2026. If an overseas client will rely on your certificate, confirm the position on both sites. To check a UK certificate after issue, UK buyers usually search UKAS CertCheck; the verification guide covers the steps when a certificate is missing.

Local practice that changes the project

AI records that match your UK GDPR records

The ICO states that the GDPR is retained in UK law as the UK GDPR, sitting alongside an amended Data Protection Act 2018. The Data (Use and Access) Act 2025 amends both, with its provisions commencing in stages. Where a model is trained on, or makes decisions about, personal data, your AI system impact assessment, data provenance records and supplier agreements will be read beside your data protection records. An auditor who finds two different descriptions of the same system will raise it, so build them from one inventory.

Selling into the EU from the UK

The European Commission's own guidance says ISO/IEC 42001 helps to set up an AI management system but is not aligned with the quality management system the EU AI Act requires. A UK provider serving EU clients should plan the two separately; the EU AI Act comparison sets out the gaps.

Audit logistics

The certification body runs a Stage 1 review and a Stage 2 audit, then surveillance at least once a calendar year and recertification before the third-year expiry. Because the scheme is new, book audit dates early.

UK items to check, and where

How Sterling works in the United Kingdom

For ISO/IEC 42001 certification in London and across the UK, Sterling supports clients from its London office, on site and remotely. Our expert and experienced AI governance consultants bring 8,100+ client engagements in 60+ countries since 2003, and we help you shortlist certification bodies whose UKAS schedule covers ISO/IEC 42001. Sterling does not certify: an independent, accredited certification body audits your AIMS and makes the decision.

ISO/IEC 42001 in the UK: questions buyers ask