hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us

China · Certification

ISO/IEC 42001 certification in China

Achieve ISO 42001 certification in China with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.

Request a discovery callTake the ISO/IEC 42001 readiness check
  • Accredited certification
  • Shanghai office team
  • Effivity software included
  • Academy training included

Who asks for ISO 42001 in China

Clients include

  • Allianz
  • Emirates Flight Catering
  • Etihad Rail
  • Haier
  • Whirlpool
  • Emerson
In short

ISO 42001 certification in China at a glance

Two Chinese instruments bear on ISO/IEC 42001. Not one of them names it. So why do buyers in China keep asking for the certificate?

Generative AI services offered to the public in China have operated under the Cyberspace Administration of China's Interim Measures since 15 August 2023, alongside the PIPL's requirement for impact assessments before automated decision-making. ISO/IEC 42001 gives an organisation a certifiable AI management system to run that governance consistently: AI policy, roles, risk and impact assessment, data and model lifecycle controls, supplier oversight, monitoring and internal audit. China adopted it quickly and identically as GB/T 45081-2024, aligned to ISO/IEC 42001:2023, so the international text and the national one say the same thing. The standard does not replace regulatory duties or filings, but it gives regulators, customers and investors evidence that those duties are managed. Artificial intelligence is a key sector in the State Council plan for the Lingang Special Area in Shanghai, where model developers and AI-enabled software firms cluster. Certification comes from CNCA-approved certification bodies with suitable accreditation. Sterling's Shanghai office builds the AI management system on existing ISO/IEC 27001 controls, with Effivity and Sterling Academy included.

The need

Who needs ISO 42001 in China, and what happens without it

In China the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.

  • Providers of generative AI services to the public in ChinaThe CAC's Interim Measures set governance duties that an AI management system helps organise.
  • AI companies in the Lingang Special AreaArtificial intelligence is one of the area's key sectors.
  • Software vendors embedding AI for overseas enterprise customersCustomers ask for AI governance assurance in procurement.
  • Organisations using personal information in automated decision-makingThe PIPL requires impact assessments before automated decision-making.

Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.

Take the ISO/IEC 42001 readiness check
Requirements

ISO 42001 requirements in China

Strip away the vocabulary and ISO/IEC 42001 requires a company to prove six things about how it governs the AI it builds or uses.

You know where AI is usedThe AI systems you develop, provide or use are identified, together with the role your organisation plays for each.
Leadership sets the rules for AITop management sets an AI policy and objectives, assigns accountability and provides resources for responsible use.
You assessed AI risks and impactsRisks from AI systems, and their impacts on individuals, groups and society, are assessed before and during use and then treated.
Each AI system is managed through its lifeDesign, data, testing, deployment, monitoring and retirement follow defined processes with records you can show.
Data and third parties are under controlThe quality and origin of data, and suppliers of models or components, are managed against your own requirements.
You monitor, audit and improveAI systems and the management system are monitored, audited internally and reviewed by management, with problems corrected.

In China these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO/IEC 42001 explained →

How Sterling gets a Chinese company certified

How to get ISO 42001 certified in China

One team from the Shanghai office carries the work from scoping to certificate. Delivery from the Shanghai office, on-site across mainland China as the scope requires; remote delivery for distributed teams.

  1. Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
  2. Gap assessment against ISO/IEC 42001 and the Chinese requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
  3. Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
  4. Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
  5. Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
Included in every engagement
  • End to end, from one team
  • Effivity ISO & GRC software
  • Preferential Sterling Academy access, with complimentary awareness training for your people
  • Internal auditor training for your audit team, as applicable to your standard
  • Vulnerability assessment on ISMS engagements

The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.

Book a free discovery call
Time

How long does ISO 42001 certification take in China?

There is no standard duration: it depends on your scope and on how much of the system already runs. In China these are the factors that set the timeline.

  • Number of AI systems and use cases in scope
  • State of AI risk and impact assessments
  • Data governance and model lifecycle records
  • Whether regulatory filings for generative AI services are already in place

Sterling agrees a dated plan with you on the discovery call, once the scope is known.

Cost

How much does ISO 42001 certification cost in China?

The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In China these factors move both.

  • Number of AI systems and teams in scope
  • AI impact assessment effort
  • Certification body audit fees, quoted separately from consulting
  • Integration with ISO/IEC 27001 and PIPL controls

Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.

Choosing a partner

ISO 42001 consultants and certification bodies in China

Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.

  • Check that the body’s accreditation or approval covers ISO 42001 and your sector, and that its certificates can be verified online.
  • Ask the consultant how the local requirements in China are mapped into the same system, so nothing runs twice.
  • Ask for client references in your sector; Sterling’s client letters are available on request.
  • Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.

Laws and regulations that drive ISO 42001 in China (3)

InstrumentHow it treats the standard
Interim Measures for the Management of Generative Artificial Intelligence Services (CAC and six departments)Expected in practice
Governance of generative AI services, in force from 15 August 2023; ISO/IEC 42001 not cited.
GB/T 45081-2024 Information technology — Artificial intelligence — Management system (identical adoption of ISO/IEC 42001:2023)National standard
Identical to ISO/IEC 42001:2023.
Personal Information Protection Law of the PRCExpected in practice
Impact assessments before automated decision-making using personal information.

"Expected in practice" means the instrument asks for the outcomes ISO/IEC 42001 covers without naming a standard, and ISO/IEC 42001 is what buyers and regulators commonly accept as evidence of them.

Accreditation, audit language and remote audits in China

ISO/IEC 42001 certification is issued by certification bodies whose accreditation covers AI management systems; in China the body must also be approved by CNCA. Accreditation availability for this standard in China has not been verified here. No body is named here unless verified. Edition and transition details: ISO/IEC 42001 hub →

Audit language

Chinese and English audits are both available from certification bodies operating in China; agree the audit language and the certificate language at application.

Remote and on-site

Remote audit elements are at the certification body's discretion.

ISO 42001 in China: questions clients ask

Is ISO 42001 a Chinese national standard?

Yes, in the sense that China has adopted it. GB/T 45081-2024, Information technology — Artificial intelligence — Management system, is an identical adoption of ISO/IEC 42001:2023. It is a voluntary standard, and the national number simply records that adoption. If a customer asks for the international name, the two refer to the same requirements.

Does ISO 42001 satisfy the generative AI Interim Measures?

No. The Interim Measures, in force from 15 August 2023, set regulatory duties and filings for generative AI services, and they do not cite ISO/IEC 42001. Those duties remain with the provider. The standard helps organise governance around them, so confirm regulatory points with the CAC or counsel.

Who can certify ISO 42001 in China?

Certification would come from a body whose accreditation covers AI management systems and which is also approved by CNCA. Accreditation availability for this standard in China has not been verified on this page, so ask any candidate body to show its accreditation scope in writing. No body is named as verified.

Read more

More on ISO 42001 for Chinese organisations

Explore

Other standards Chinese businesses ask Sterling for

Organisations in China often combine ISO/IEC 42001 with one of these, under one management system where the scopes allow.

ISO/IEC 27001 in ChinaSecuring the data and systems AI depends on.Pairs with ISO 42001ISO/IEC 27701 in ChinaPersonal data used to train and run AI.Pairs with ISO 42001ISO 9001 in ChinaAsked of: export and contract manufacturers supplying overseas brands.ISO 14001 in ChinaAsked of: manufacturers holding pollutant discharge permits.ISO 45001 in ChinaAsked of: manufacturing and processing plants.Personal Information Protection Law (PIPL) in ChinaAsked of: any organisation processing personal information of natural persons in China.

All 21 standards Sterling delivers in China →

Next step

Start with a free discovery call from the Shanghai office

A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.

Book a discovery callTake the ISO/IEC 42001 readiness check

Sources

  1. Interim Measures for the Management of Generative Artificial Intelligence Services (CAC and six departments) — gov.cn (accessed 5 Oct 2026)
  2. GB/T 45081-2024 Information technology — Artificial intelligence — Management system (identical adoption of ISO/IEC 42001:2023) — std.samr.gov.cn (accessed 5 Oct 2026)
  3. Personal Information Protection Law of the PRC — cac.gov.cn (accessed 5 Oct 2026)
  4. Certification and Accreditation Administration of the People's Republic of China (CNCA) — the State Council's certification and accreditation supervision and administration department — gov.cn (accessed 5 Oct 2026)

Talk to a consultant

Plan your certification with the Shanghai team.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

china@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice

Request a call