ISO 42001 certification cost: what moves the price, and what does not

Why ISO/IEC 42001 has no list price

Two organisations of the same size can face very different AIMS budgets: one uses a few off-the-shelf AI tools in back-office work, the other trains its own models and sells them in a product that makes decisions about people. The standard applies to both; the assessment, control and record-keeping work does not.

That work lands in three places:

• The consulting fee, if you use a consultant: gap analysis, AI policy, risk and impact assessment methods, Statement of Applicability, records, training, internal audit and audit preparation.
• The certification body's fee: the Stage 1 readiness review, the Stage 2 audit, the certification decision, the surveillance audits in the following two years and recertification in the third. Accreditation rules keep the two fees apart, because a certification body may not also offer management system consultancy.
• Your internal time: the AIMS lead, the owners of each AI system, data science, legal and procurement, all of whom sit in workshops and change how they document and approve work.

Programme length also affects cost; the ISO/IEC 42001 timeline guide covers it.

What moves the price: the seven cost drivers

The same facts push on both fees: a consultant prices building the system, a certification body the time to test it.

How the certification body works out audit time

A certification body does not choose a number of audit days by feel. Under ISO/IEC 17021-1, the standard every accredited management system certification body works to, it must have documented procedures for determining audit time and must record both the duration and the reasons for it.

The aspects it must weigh include the requirements of the standard, the complexity of your organisation and its system, the technological and regulatory context, outsourcing, earlier audit results, the size, number and location of sites, the risks of your activities, and whether the audit is combined or integrated with another standard. An organisation whose AI supports regulated decisions in finance, health or employment will see that context reflected.

For ISO/IEC 42001, ISO/IEC 42006, published in July 2025, adds requirements specific to bodies that audit and certify AI management systems, on top of ISO/IEC 17021-1. You need not reproduce its method, but ask each body to show the audit days for Stage 1, Stage 2, each surveillance audit and recertification, and the facts about your scope on which they are based.

What does not change the cost

The certificate itself. The fee pays for independent assessment and a decision, not for a document. A much lower price for "the same certificate" usually signals fewer audit days, a narrower scope than you intended, or a body without accreditation for this standard.

A transition. ISO/IEC 42001:2023 is the first edition, and no amendment or revision has been published, so there is no transition to budget for today.

The EU AI Act. Certification does not deliver conformity with the Act; work under the regulation is budgeted separately. The guide to ISO/IEC 42001 and the EU AI Act sets out what the certificate does not give.

Hidden costs in an AI management system budget

Most AIMS overruns come from items quotations leave out.

• The AI inventory that was never done. Scope, and therefore every quotation, rests on knowing which AI systems exist. When shadow use of AI tools surfaces after the proposal, the scope grows and so does the work. The scope guide explains how to draw the boundary.
• Assessments that must be repeated. The standard requires AI risk assessments and impact assessments at planned intervals and when significant changes occur. A method that takes weeks per system becomes a recurring cost; a proportionate one does not.
• Supplier and customer agreements. Agreeing responsibilities with model providers and customers can need legal review that no consultant's fee covers.
• A body not accredited for ISO/IEC 42001. Accredited certification for this standard is newer than for established standards. A certificate from a body without accreditation for it may be refused by the customer or tender panel that asked for it, and the audits are then paid for twice.
• Follow-up audits. A major nonconformity at Stage 2 has to be verified as corrected before certification; if that is not done in the period the body sets, Stage 2 is repeated. Extending the scope to new AI systems later, or a short-notice audit, also adds days.
• Surveillance left out of the quotation. Some quotations cover only the initial audit, although annual surveillance and recertification are part of every certification cycle.

How to compare ISO/IEC 42001 quotations

First make every quotation describe the same scope.

Certification bodies

• Accreditation for ISO/IEC 42001 in particular: which accreditation body granted it, against ISO/IEC 17021-1 with ISO/IEC 42006, and does its public register confirm it? The guide to choosing a certification body goes further.
• The same AI systems, roles, sites and people in every quotation.
• Audit days for each stage and each year of the cycle, with the reasons.
• The three-year total, including annual charges, travel (fixed or at cost) and follow-up visit rates.

Consultants

• An all-inclusive proposal for a written scope, or an open-ended daily rate?
• Who produces the risk and impact assessments and the Statement of Applicability: your team, the consultant, or both together?
• Whether an existing ISMS is reused, or a second system is built beside it.
• Whether internal audit, management review, training, software and support through the certification audit are included.
• Any offer that bundles consulting and a certificate into one price, or promises certification in days, is a warning sign.

ISO 42001 certification cost: questions buyers ask