ISO 42001 Explained for US AI Companies

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

What you get. One independently audited answer to the AI governance questions in US deals, prepared for you by Sterling and audited by an accredited certification body. Sterling does not certify.

ISO/IEC 42001:2023 is the international management system standard for artificial intelligence^[1]. It is voluntary, and no US federal statute makes it compulsory. It turns up on a US founder's desk in three ways:

• US enterprise security reviews. In Sterling's experience, questionnaires from large US customers now carry AI sections: training data, model approval, human oversight and the third-party models under your product.
• US government buyers. Federal agencies buy AI under written OMB rules, covered in the next section.
• US investors and boards. In Sterling's experience, diligence on an AI company now reaches governance of its models, not only its security.

A certificate gives every one of these readers the same evidence: an AI management system that runs, has records, and was examined by someone independent.

What you get. A clear view of which US texts touch your product, with records ready for each.

• Federal acquisition. OMB Memorandum M-25-22, dated April 3, 2025, governs how agencies acquire AI^[5]. It applies to contracts awarded from solicitations issued 180 days or more after the memo, and to options exercised after that point^[5]. For high-impact use cases, it says agencies should require enough descriptive information from vendors to complete the required AI Impact Assessment^[5]. The memo does not name ISO/IEC 42001; in Sterling's view, an operating management system is the simplest way to have that information on file.
• NIST AI RMF. Released January 26, 2023, intended for voluntary use, and now being revised as part of the White House AI Action Plan^[2]. It has four functions: Govern, Map, Measure and Manage^[3]. Our ISO 42001 vs NIST AI RMF guide compares the two.
• Colorado. SB 26-189, signed May 14, 2026, repeals and re-enacts the state's 2024 AI law around automated decision-making technology used in consequential decisions^[6]. From January 1, 2027, developers of a covered technology must give deployers technical documentation on intended uses, training data categories, known limits and human review, and both must keep compliance records for at least 3 years^[6]. The act does not name ISO/IEC 42001; a management system produces exactly this kind of documentation.
• Other states. We check the official legislature or attorney-general text for each state where you sell during the gap assessment.

What you get. A system built around how your engineers already ship, so the audit evidence comes from real work.

The standard covers how your company governs the AI it builds or uses. It does not score a model's accuracy or fairness. The table is Sterling's summary of what an auditor and a US vendor-risk team expect to find, not text from the standard.

Describe it precisely and it wins trust; overstate it and it becomes a contract risk.

• Not legal compliance. No US or EU law is satisfied by a certificate alone. For European exposure, Regulation (EU) 2024/1689 reaches certain providers outside the Union, including where an AI system's output is used in the Union^[4]. See ISO 42001 and the EU AI Act for US companies.
• Not model quality. It shows a disciplined way of managing accuracy, bias and misuse questions, not that every answer is right.
• Not security assurance. US buyers will still want a SOC 2 report or ISO/IEC 27001 for your cloud environment. One shared control set serves all of them; see SOC 2 vs ISO 27001.

Start now if:

• US enterprise questionnaires already include AI sections you answer from scratch each time.
• US public-sector or regulated buyers want documented AI risk and impact work.
• You sell into Europe and customers' counsel is asking about AI governance.
• You already hold SOC 2 or ISO/IEC 27001 and want AI on the same footing.

You can wait if: AI is only an internal productivity tool, your buyers accept a short AI policy, or your product changes too fast to fix a scope this quarter. Even then, write the AI policy and the risk method now; certificates come later.

What you get. Done-for-you consulting with a 100% success and on-time completion record across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never audit you.

1. Free gap assessment. Your AI systems, data flows and evidence, with a proposed scope and schedule. 2. Build. We draft the policy, risk method, lifecycle procedures and supplier rules in your team's language. 3. Operate. Your team runs the system while records build up; Effivity, Sterling's GRC automation platform, holds them. 4. Internal audit and management review. Findings are closed before anyone external looks. 5. Certification audit. We coordinate with the accredited body you choose and support you to its decision.

The calendar depends on scope, how much evidence your tools already hold, existing ISO/IEC 27001 or SOC 2 routines, and whether you train models or build on someone else's. A fixed schedule and quote follow the gap assessment.

This is Sterling's recommendation, not a requirement of ISO, NIST or any US regulator.

1. Write the AI policy and the risk and impact method first; they answer most buyer questions. 2. Scope the product US buyers are actually evaluating, including the model pipeline behind it. 3. Keep SOC 2 or ISO/IEC 27001 on the plan, since most US buyers still check security first. 4. Use NIST AI RMF terms in your risk method when customers use them. 5. State your status exactly: "in progress", "internally audited" or "certified by [accredited body] for [scope]". Background is on the ISO 42001 hub.

Want a dated plan for your first certificate? Get started and a Sterling expert will reply.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• ISO/IEC 42001: standard overviewStandard overview
• NIST AI RMF: standard overviewStandard overview
• EU AI Act: standard overviewStandard overview
• ISO/IEC 27001: standard overviewStandard overview
• SOC 2: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• ISO 42001 vs NIST AI RMF: Which Do US AI Companies Need?United States
• ISO 42001 and the EU AI Act for US CompaniesUnited States
• SOC 2 vs ISO 27001 for US Companies: Which to Start WithUnited States
• ISO/IEC 42001 for US AI Companies: What Buyers and Rules RequireUnited States
• Sterling in the United StatesUnited States

1. ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system (title as listed). ISO. accessed October 23, 2026.

2. AI Risk Management Framework (overview page: voluntary use; released January 26, 2023; being revised as part of the White House AI Action Plan). NIST. accessed October 26, 2026.

3. Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1. NIST. accessed October 26, 2026.

4. Regulation (EU) 2024/1689 (Artificial Intelligence Act), as published in the Official Journal. EUR-Lex. accessed October 23, 2026.

5. OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government (April 3, 2025). Executive Office of the President, OMB (whitehouse.gov). accessed October 26, 2026.

6. SB26-189 Automated Decision-Making Technology (bill page and signed act, May 14, 2026; status: became law). Colorado General Assembly. accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.