ISO/IEC 42001 for US SaaS Companies with AI Features

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome. One audited answer to every AI addendum and AI questionnaire your US customers send, instead of a fresh write-up per deal. We build the system with you; an accredited certification body audits it and decides on the certificate.

ISO/IEC 42001:2023 is titled Information technology, Artificial intelligence, Management system^[1]. It is voluntary, and no US law requires a SaaS company to hold it. It becomes a sales requirement once your product ships an assistant, summarizer, recommendation engine or automated decision. In Sterling's experience, US SaaS vendors meet it in four forms:

• AI addenda to the MSA. Your customer asks you to describe how you govern the AI in your product.
• Supplementary AI questionnaires. Procurement adds sections on model sourcing, training data and human oversight.
• RFP questions. Whether you hold an independently audited AI management certificate.
• Flow-down from regulated customers. Their boards and regulators push them to document third-party AI, and that lands on you.

A SaaS vendor sits in the middle of the chain: supplier to your customer, customer of a foundation-model provider. A certificate answers for the whole chain in one portable document.

The outcome. You know which US texts shape your customers' questions, and you hold records for each.

• Federal AI contracts. OMB Memorandum M-25-22, dated April 3, 2025, applies to contracts awarded from solicitations issued 180 days or more after it^[3]. Agencies must ensure contracts permanently prohibit using non-public inputted agency data and outputted results to further train publicly or commercially available AI algorithms, absent explicit agency consent^[3]. They must also address vendor lock-in and agency data handling^[3]. If a SaaS feature sends agency data to a model, you need records proving where it goes.
• NIST AI RMF. Released on January 26, 2023 for voluntary use^[2]. NIST released the Generative Artificial Intelligence Profile, NIST-AI-600-1, on July 26, 2024^[2], and states that the AI RMF 1.0 is being revised as part of the White House AI Action Plan^[2]. There is no certificate route.
• State AI rules. These keep changing, so during the gap assessment we check the official text for each state where you sell.

The outcome. A scope your US buyers recognize as the product they are paying for.

• Feature-level. Only the AI-enabled features: the assistant, classifier or generator. A focused first certificate.
• Product-level. The whole platform, where AI runs throughout. More work, a cleaner message.
• Role statement. Whether you develop AI components, use another provider's models, or both. Most SaaS vendors are both.

The scope then names the features and the model behind each, the data used to configure, ground or evaluate them, the accountable teams, the model and data suppliers, and where the features run. State clearly whether customer content trains or improves models, and whether it reaches an outside provider. Exclude beta features openly so the certificate never promises more than was audited.

The outcome. AI governance folded into your release process, not a new committee.

1. AI policy. A short document leadership signs: what you build, what you refuse, how customer data is treated in AI features. 2. Feature intake. A one-page record per AI feature (purpose, inputs, model, users, known limits) with a named approver. 3. Impact review. Who is affected if an output is wrong, biased, leaked or misused, and what reduces that risk. Repeated on material change. 4. Testing and monitoring. Evaluation before release; drift, complaints, abuse and cost signals afterward, with an owner. 5. Model and data suppliers. A register of providers, their data terms, and your response when a provider changes a model. 6. Customer transparency. What the feature does, its limits, when a human should check, and how to report a problem.

These sit on the usual ISO spine of controlled documents, internal audit, management review and corrective action. If you run SOC 2 or ISO 27001, much of that spine exists already.

The outcome. We fix these before the certification body arrives.

• "It's just an API call." US customers hold you answerable for what you ship, whoever trained the model.
• Feature described, data not. Buyers care most about their own content.
• Approvals in chat threads. Auditors need a dated release record.
• Supplier model drift. Provider updates can change behavior without a line of your code changing.
• A policy written apart from engineering. It will not match reality.
• Overclaiming. The certificate shows an audited management system, not legal compliance or accurate outputs.

The outcome. A certificate on schedule, with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. Sterling does not certify, and the people who consult never audit you.

1. Free gap assessment. AI features, data flows, supplier terms and current evidence, with a recommended scope. 2. Design. Policy, intake template, impact method and supplier rules, built into your release process. 3. Operation. Your team runs the system; Effivity, our GRC automation platform, holds the registers and records. 4. Internal audit and management review. We test first and close the findings. 5. Certification audit. We coordinate the accredited body you choose and support you to its decision.

Ready to answer your next AI addendum with a certificate? Get started and a Sterling expert will scope your AI features with you.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• ISO/IEC 42001: standard overviewStandard overview
• NIST AI RMF: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• ISO 42001 vs NIST AI RMF: Which Do US AI Companies Need?United States
• How US Start-ups Answer Security Questionnaires FastUnited States
• SOC 2 for US SaaS Companies: What Enterprise Buyers RequireUnited States
• ISO/IEC 42001 for US AI Companies: What Buyers and Rules RequireUnited States
• Sterling in the United StatesUnited States

1. ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system. ISO. accessed October 23, 2026.

2. AI Risk Management Framework (overview page: voluntary use; released January 26, 2023; NIST-AI-600-1 Generative AI Profile released July 26, 2024; AI RMF 1.0 being revised under the White House AI Action Plan). NIST. accessed October 26, 2026.

3. OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government (April 3, 2025). Executive Office of the President, OMB (whitehouse.gov). accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.