ISO 42001 Certification: From Gap Analysis to Your ISO Certificate

Why it matters

AI governance is now a buying criterion. A third-party certificate answers customer questionnaires, procurement checks and regulator questions in one document, and gives you a structure that supports EU AI Act readiness.

Why it matters for data and AI

This is the AI standard. Annex A covers data for AI systems, impact assessment, lifecycle controls and third-party AI.

Who needs it

• Companies that build, deploy or embed AI in products or operations
• SaaS, fintech, healthtech and HR-tech vendors answering enterprise AI due-diligence
• Global capability centres and IT services firms serving regulated clients
• Organisations preparing for EU AI Act obligations

See the ISO 42001 consulting programme →

Who issues it

An accredited certification body. We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Context, scope and gap analysis against all clauses and Annex A controls
• AI risk assessment, AI impact assessments and Statement of Applicability
• The full AIMS documentation set (17+ documents: policy, governance model, SDL, data governance, incident response and more)
• Control implementation, role-based training and monitoring set-up
• Full internal audit and management review
• Certification body selection, Stage 1 and Stage 2 audit accompaniment
• Surveillance planning after you are certified

Typical timeline

Typically 6 to 9 months, depending on scope and starting maturity.

The steps

• Context & scoping: define the AIMS boundary and interested parties
• Gap analysis against ISO 42001 requirements and Annex A
• AI risk assessment and treatment plan
• Documentation: policies, procedures, Statement of Applicability
• Implementation, training and evidence
• Internal audit and nonconformity closure
• Management review and certification-readiness declaration
• Stage 1 and Stage 2 audits, certificate issued

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for ISO/IEC 42001.

What moves the price for ISO/IEC 42001

Number of AI systems in scope, organisation size and sites, existing ISO 27001 maturity, and how much documentation already exists.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.

Scope tiers: Essentials (up to 3 AI systems), Professional (up to 10) and Enterprise (unlimited), priced after a scoping call.

Why it matters

Customers and procurement teams treat ISO 27001 as the baseline proof that you protect their data. It is also the strongest head start for AI governance, because the management-system machinery is shared.

Why it matters for data and AI

Protects the data your models learn from and the systems they run on. Annex A access, logging, supplier and secure-development controls carry straight into your AIMS.

Who needs it

• SaaS, IT services and data companies selling to enterprises
• Teams answering repeated security questionnaires
• Organisations planning ISO 42001, SOC 2 or CMMC next

Who issues it

An accredited certification body. We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Scope, gap analysis and risk assessment
• Statement of Applicability against Annex A controls
• ISMS policies, procedures and records
• Control implementation, awareness training and evidence
• Internal audit and management review
• Certification body liaison and audit accompaniment

Typical timeline

Scoped after a gap assessment. Run with ISO 9001 as a two-standard programme, we typically plan 6 to 9 months.

The steps

• Scope and gap analysis
• Risk assessment and Statement of Applicability
• Policies, procedures and control build
• Training, evidence and monitoring
• Internal audit and management review
• Stage 1 and Stage 2 audits, certificate issued

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for ISO/IEC 27001.

What moves the price for ISO/IEC 27001

Headcount, number of sites, cloud and application estate, and existing control maturity.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.

Why it matters

Privacy law now reaches AI training data. A certified privacy system gives you a documented answer on consent, purpose limitation and data-subject rights across DPDP and GDPR-style regimes.

Why it matters for data and AI

Directly addresses personal data in training sets, provenance and permitted use.

Who needs it

• Data-heavy businesses and processors handling personal data
• Companies serving EU or Indian customers with DPDP or GDPR obligations
• AI teams training on personal or special-category data

Who issues it

An accredited certification body. We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Privacy gap analysis and data-flow mapping
• Roles and responsibilities for controllers and processors
• Privacy policies, records of processing and impact assessments
• Data-subject request and breach procedures
• Internal audit and certification body liaison

Typical timeline

Scoped after a gap assessment. Adds incrementally when ISO 27001 is already in place.

The steps

• Personal-data inventory and gap analysis
• Privacy risk and impact assessment
• Policies, records and rights procedures
• Implementation and training
• Internal audit
• Certification audit and certificate

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for ISO/IEC 27701.

What moves the price for ISO/IEC 27701

Volume and sensitivity of personal data, number of processing activities and jurisdictions.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.

Why it matters

Quality management shows you deliver predictably. It shares its structure with ISO 27001 and 42001, so adding it to an integrated system costs less than running it alone.

Why it matters for data and AI

Gives AI and data delivery teams repeatable processes, which is what AIMS operational controls depend on.

Who needs it

• IT services and delivery organisations
• Firms bidding for government and enterprise tenders
• Teams building a base for CMMI or ISO 42001

Who issues it

An accredited certification body. We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Process mapping and gap analysis
• Quality policy, objectives and procedures
• Document control, internal audit and management review
• Customer-satisfaction and corrective-action routines
• Certification body liaison

Typical timeline

Run with ISO 27001 as a two-standard programme, we typically plan 6 to 9 months.

The steps

• Process mapping and gap analysis
• Quality manual, policy and objectives
• Procedure build and training
• Internal audit and management review
• Stage 1 and Stage 2 audits, certificate issued

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for ISO 9001.

What moves the price for ISO 9001

Number of processes and sites, headcount, and how formal your delivery processes already are.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.

Why it matters

When a model, pipeline or cloud region fails, customers want evidence of tested recovery. ISO 22301 turns that into an audited system.

Why it matters for data and AI

Covers recovery of data stores, pipelines and model-serving platforms.

Who needs it

• Platform, fintech and managed-service providers with uptime commitments
• Regulated clients that demand continuity evidence
• Operators of business-critical data and AI services

Who issues it

An accredited certification body. We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Business impact analysis and risk assessment
• Continuity strategies and plans for critical services
• Exercise and test programme
• Internal audit and management review
• Certification body liaison

Typical timeline

Scoped after a business impact analysis. Layers onto an existing integrated system.

The steps

• Business impact analysis
• Continuity strategy and plans
• Exercises and testing
• Internal audit and management review
• Certification audit and certificate

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for ISO 22301.

What moves the price for ISO 22301

Number of critical services, sites and recovery-time objectives.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.

Why it matters

Running AI and data services reliably is an operations discipline. ISO 20000-1 audits incident, change, release and capacity management against an international standard.

Why it matters for data and AI

Applies the same operational rigour to model-serving and data services.

Who needs it

• Managed-service, cloud and data-platform providers
• Internal IT and data teams that operate services for the business

Who issues it

An accredited certification body. We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Service catalogue and SLA design
• Incident, problem, change and release processes
• Service-level reporting and continual improvement
• Internal audit and certification body liaison

Typical timeline

Scoped after a gap assessment. Reuses the shared management-system foundation.

The steps

• Gap analysis against the service management system
• Process design and service catalogue
• Implementation and evidence
• Internal audit and management review
• Certification audit and certificate

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for ISO/IEC 20000-1.

What moves the price for ISO/IEC 20000-1

Number of services, customers and tooling already in use.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.

Why it matters

Selling into the US usually means a SOC 2 report. Type I confirms controls are designed properly at a point in time. Type II confirms they operated effectively over a period.

Why it matters for data and AI

Security, availability and confidentiality criteria reuse the access, monitoring and change evidence your AI platform already needs.

Who needs it

• SaaS and cloud vendors selling to US enterprises
• Data and AI platform providers handling customer data
• Teams already running ISO 27001

Who issues it

An independent licensed CPA firm. We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Scoping against the Trust Services Criteria (Security, Availability, Confidentiality and more)
• Gap analysis and control design
• Policies, evidence collection and monitoring
• Readiness assessment before the audit window
• Coordination with the CPA firm

Typical timeline

Type I readiness first. Type II needs an observation window, commonly several months, set with your auditor.

The steps

• Scope and criteria selection
• Gap analysis and control design
• Evidence and monitoring set-up
• Readiness assessment
• CPA firm examination, report issued

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for SOC 2.

What moves the price for SOC 2

Criteria in scope, system complexity, observation period length and the CPA firm's fee.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.

Why it matters

Many government and enterprise buyers screen suppliers by CMMI level. A rating also proves your data and AI delivery is repeatable rather than heroic.

Why it matters for data and AI

Adds the statistical and process rigour that sits on top of your ISO management systems.

Who needs it

• IT, data and AI services firms bidding for government and global contracts
• Delivery organisations that want predictable quality and cost

See the CMMI consulting programme →

Who issues it

An authorised CMMI Lead Appraiser, through a SCAMPI Class A appraisal. We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Process-area mapping and gap analysis
• Awareness workshops and process design sprints
• Pilot implementation, coaching and rollout
• Class C diagnostic, Class B readiness and mock appraisal
• Class A appraisal preparation and support

Typical timeline

A typical engagement runs around 40 weeks from awareness workshops to the Class A appraisal.

The steps

• Class C quick-look diagnostic
• Gap closure and process design
• Pilot, coaching and rollout
• Class B readiness assessment
• Class A official appraisal

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for CMMI Level 3 and 5.

What moves the price for CMMI Level 3 and 5

Target maturity level, number of projects and teams in scope, and appraisal on-site days.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.

Why it matters

Level 2 is an audit against the 110 practices of NIST SP 800-171. If you handle controlled unclassified information in the defense supply chain, it decides whether you keep your contracts.

Why it matters for data and AI

CUI is data. The programme governs where it lives, who touches it and how it is protected.

Who needs it

• Contractors and subcontractors handling federal contract information or controlled unclassified information
• Technology suppliers inside US defense supply chains

Who issues it

A CMMC third-party assessor (C3PAO). We run the programme that gets you ready, accompany you through the audit, and stay independent of the body that issues the result.

What is included

• Scoping of FCI and CUI data flows
• System Security Plan and the required practice artefacts
• Crosswalk of NIST 800-171 to ISO 27001 Annex A and SOC 2 evidence
• Mock audits for assessor readiness
• Plan of Action and Milestones support

Typical timeline

A stand-alone CMMC project commonly runs 6 to 12 months. With ISO 27001 or SOC 2 evidence already in place, it becomes an extension of existing work.

The steps

• Data and scope determination (FCI or CUI)
• Gap assessment against 110 practices
• System Security Plan and evidence build
• Mock assessment
• C3PAO assessment

The honest answer is that cost depends on scope, and we quote after a short scoping call rather than publish numbers that would not fit your situation. Here is where the money goes and what moves it for CMMC 2.0.

What moves the price for CMMC 2.0

Level required (1 or 2), size of the CUI environment, existing security maturity and C3PAO fees.

Where the money goes

How we keep it down

• Build once, certify many. Standards that share the Annex SL structure (ISO 42001, 27001, 9001, 22301) reuse the same policy, risk, audit and review machinery.
• Tighten the scope. Certify the AI systems, sites and business units that customers actually ask about, then widen.
• Reuse what you hold. An existing ISO 27001 system gives you a head start on ISO 42001, and the same evidence supports SOC 2 and CMMC.
• Combine the audits. One audit programme across standards cuts surveillance days. In one anonymised engagement, combined surveillance ran 6 days against 14 for separate audits.