ISO/IEC 42001 for US AI Companies: What Buyers and Rules Require

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome: an independently audited AI management system that your US buyers' vendor-risk teams can read once, instead of a fresh written answer for every review. We prepare you; an accredited certification body audits and decides on the certificate.

No US law says a US company must hold ISO/IEC 42001. It is a voluntary international standard for AI management systems^[1]. It becomes necessary when a contract, investor or procurement team makes it so. Three US situations bring it up.

• US enterprise buyers. In Sterling's experience, vendor reviews at large US customers now carry AI sections: your AI policy, how you assess AI risk, who approves a model before release, and which outside models sit underneath your product.
• US federal supply chains. Agencies buying AI work to rules you can read (next section). A documented AI management system gives you the records to answer them.
• US investors and boards. In Sterling's experience, diligence on an AI company now covers governance of its models, not only its security.

The outcome: you know which US rules touch your product and have evidence ready for each.

• Federal procurement. OMB Memorandum M-25-22, dated April 3, 2025, sets how federal agencies acquire AI^[5]. It applies to contracts awarded from solicitations issued 180 days or more after the memorandum^[5]. For AI with potential high-impact uses, agencies must inform vendors of the transparency and documentation they will need, such as descriptive information to complete an AI Impact Assessment^[5]. The memorandum does not name ISO/IEC 42001; Sterling's view is that a working management system is the natural way to produce that documentation.
• NIST AI RMF. Released on January 26, 2023 for voluntary use^[2], with four functions: Govern, Map, Measure and Manage^[3]. NIST's page states that the AI RMF 1.0 is being revised as part of the White House AI Action Plan^[2]. It has no certification route.
• State AI laws. These are changing. During the gap assessment we check the current official legislature or attorney-general text for each state where you sell, and map your evidence to it.

The outcome: a clear answer on whether the EU AI Act reaches you, and governance that supports your response.

Regulation (EU) 2024/1689, the AI Act, applies to providers placing AI systems on the market in the Union "irrespective of whether those providers are established or located within the Union or in a third country"^[4]. It also reaches providers and deployers in a third country where the system's output is used in the Union^[4]. A US company with European customers can be in scope.

ISO/IEC 42001 is not the AI Act, and a certificate does not by itself show legal compliance. What it gives you is the roles, risk process and documentation that a compliance effort needs. Check application dates against the Official Journal text before planning around them.

The outcome: a scope statement that matches the products your US customers are actually buying, so the certificate means something in procurement.

• Products. Hosted model APIs, AI features inside SaaS, agents and copilots, decision-support tools.
• Models. Trained from scratch, fine-tuned, or configured with prompts and retrieval on a base model.
• Data pipelines. Collection, labeling, training and evaluation sets, production feedback loops.
• Third parties. Foundation-model providers, annotation vendors, data suppliers, open-source components.

Five areas carry most of the weight in the audit:

1. AI policy and leadership. A short policy approved by top management, with objectives and scheduled reviews. 2. Roles and accountability. A named owner per AI system and a release approver. 3. AI risk and impact assessment. One repeatable method applied to every new system and material change. 4. Data and model lifecycle. Data quality and rights, testing before release, monitoring in production, retirement. Much of this evidence already sits in your engineering tools. 5. Third-party models and suppliers. How you select, monitor and respond when a provider changes a model.

Around these five sits the usual ISO discipline: controlled documents, internal audit, management review and corrective action.

The outcome: we remove these delays before the audit.

• Policy without records. Auditors and buyers want completed risk assessments and dated release approvals.
• The key model scoped out. A certificate that excludes the product being bought helps no one.
• "The vendor handles it." If you build on a third-party model, show how you evaluate it and what customers are told.
• Risk stops at security. Bias, misuse, unsafe reliance and privacy belong in the same method.
• Overclaiming. Describe the certificate accurately: an independently audited AI management system, not proof of legal compliance.

The outcome: a successful audit on schedule, with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never audit you, and Sterling does not certify.

1. Free gap assessment. We review your AI systems, data flows and evidence, and give you a plain-language report with a proposed scope. 2. Design. We draft the policy, roles, risk method and lifecycle procedures around how your engineers already work. 3. Evidence. We help you build real records. Effivity, our GRC automation platform, holds the register and evidence trail. 4. Internal audit and review. We test the system first and fix findings. 5. Certification body audit. We coordinate the audit with the accredited body you select and support you to the decision.

Ready to start? Use Get started and a Sterling expert will respond.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• ISO/IEC 42001: standard overviewStandard overview
• NIST AI RMF: standard overviewStandard overview
• EU AI Act: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• ISO 42001 vs NIST AI RMF: Which Do US AI Companies Need?United States
• ISO 42001 and the EU AI Act for US CompaniesUnited States
• Sterling in the United StatesUnited States

1. ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system. ISO. accessed October 24, 2026.

2. AI Risk Management Framework (overview page: voluntary use; released January 26, 2023; being revised under the White House AI Action Plan). NIST. accessed October 24, 2026.

3. Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1. NIST. accessed October 23, 2026.

4. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 1, 2, 3 and 113. EUR-Lex. accessed October 23, 2026.

5. OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government (April 3, 2025). Executive Office of the President, OMB (whitehouse.gov). accessed October 24, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.