# Who does data protection, AI governance and cyber security work?

Providers · 140

Advisory firms, certification bodies and software products are scored on the same six questions. Each group is listed A to Z, not by score.

In a particular situation? [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md), [Seeking ISO 42001 certification](https://theassurancedesk.com/best/certification-seeking.md), [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md), [Exposed to the EU AI Act](https://theassurancedesk.com/best/eu-ai-act-exposed.md), [Switching provider](https://theassurancedesk.com/best/switching-provider.md), [Regulated sectors](https://theassurancedesk.com/best/sector-regulated.md), [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident.md)

**What this directory covers.** Every provider here was selected for data-protection, AI-governance or security-assurance work: certification and audit readiness, such as ISO 27001, Cyber Essentials and SOC 2.

## Advisory firms (80)

Consultancies and law firms that advise you or do the work, such as acting as your DPO or preparing you for an audit.

- [AARC-360](https://theassurancedesk.com/advisers/aarc-360.md): Advisory firm. Relevant if you are a US group that wants one adviser across the EU GDPR, HIPAA and CCPA. (First DPO or AI policy, Seeking ISO 42001 certification)
- [Accorian (Esha Corporation dba Accorian; Accorian Assurance)](https://theassurancedesk.com/advisers/accorian.md): Advisory firm. Relevant if you need SOC 2 or ISO 27001 work and ISO 42001 help from the same firm. (Seeking ISO 42001 certification, Regulated sectors, After a ransomware or security incident)
- [Actica Consulting Limited](https://theassurancedesk.com/advisers/actica-consulting-limited.md): Advisory firm. Relevant if you run essential services and need NCSC-assured security architecture, risk or audit work. (Regulated sectors, Seeking ISO 42001 certification)
- [Aleada Consulting](https://theassurancedesk.com/advisers/aleada-consulting.md): Advisory firm. Relevant if you are a US tech or finance company appointing a first privacy adviser. (First DPO or AI policy, Regulated sectors)
- [Amethyst Risk Management Limited](https://theassurancedesk.com/advisers/amethyst-risk-management.md): Advisory firm. Relevant if you need a Cyber Assessment Framework audit from an NCSC-listed firm, or ISO/IEC 27001 help. (Regulated sectors, Seeking ISO 42001 certification, First DPO or AI policy)
- [Ametros Group](https://theassurancedesk.com/advisers/ametros-group.md): Advisory firm. Relevant if you want a budget figure before you call, and a DPO the firm says it employs. (First DPO or AI policy, Regulated sectors, Exposed to the EU AI Act, Switching provider)
- [AMSA InfoSec Ltd](https://theassurancedesk.com/advisers/amsa-infosec.md): Advisory firm. Relevant if you buy through G-Cloud and want a published day rate and a named consultant. (Seeking ISO 42001 certification, First DPO or AI policy)
- [Anekanta Consulting](https://theassurancedesk.com/advisers/anekanta-consulting.md): Advisory firm. Relevant if your board uses higher-risk AI, such as biometrics, and needs an EU AI Act risk assessment. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [Apache Consulting (Apache Consults / Vadasz Ventures)](https://theassurancedesk.com/advisers/apache-consulting.md): Advisory firm. Relevant if you want outsourced Chief Privacy Officer help and will confirm the firm's legal entity first. (First DPO or AI policy)
- [Arcanum Cyber Security (Arcanum Information Security Limited)](https://theassurancedesk.com/advisers/arcanum-cyber-security.md): Advisory firm. Relevant if you need NCSC-assured audit, risk management or security architecture work in a regulated sector. (First DPO or AI policy, Regulated sectors, After a ransomware or security incident)
- [Athlex](https://theassurancedesk.com/advisers/athlex.md): Advisory firm. Relevant if you are a start-up or small business and want a DPO at a known monthly price. (First DPO or AI policy)
- [AvISO Consultancy](https://theassurancedesk.com/advisers/aviso-consultancy.md): Advisory firm. Relevant if you are already working towards several ISO certificates and want DPO support alongside. (Seeking ISO 42001 certification, Regulated sectors, First DPO or AI policy, Exposed to the EU AI Act)
- [BABL AI Inc.](https://theassurancedesk.com/advisers/babl-ai.md): Advisory firm. Relevant if you sell hiring software and need a New York City Local Law 144 bias audit. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [BD Emerson LLC](https://theassurancedesk.com/advisers/bd-emerson.md): Advisory firm. Relevant if you want a named privacy lead with IAPP credentials for DPO or AI-governance work. (First DPO or AI policy, Exposed to the EU AI Act, Regulated sectors)
- [Bird & Bird LLP](https://theassurancedesk.com/advisers/bird-and-bird-llp-uk.md): Advisory firm. Relevant if you face a breach, a regulator investigation or EU AI Act exposure and need lawyers. (Exposed to the EU AI Act, After a breach or ICO contact, First DPO or AI policy)
- [Bratby Law](https://theassurancedesk.com/advisers/bratby-law.md): Advisory firm. Relevant if you run a telecoms or AI-product business and want a partner's advice at an agreed fee. (After a breach or ICO contact, Exposed to the EU AI Act, Regulated sectors)
- [Bridewell](https://theassurancedesk.com/advisers/bridewell.md): Advisory firm. Relevant if you run critical infrastructure or a regulated business and want privacy help inside a security firm. (First DPO or AI policy, Seeking ISO 42001 certification, After a breach or ICO contact, Exposed to the EU AI Act, Regulated sectors, After a ransomware or security incident)
- [Bright Defense, LLC](https://theassurancedesk.com/advisers/bright-defense.md): Advisory firm. Relevant if you need SOC 2 or ISO 27001 readiness and want a published starting price. (Seeking ISO 42001 certification, Regulated sectors)
- [C3IA Solutions Limited](https://theassurancedesk.com/advisers/c3ia-solutions.md): Advisory firm. Relevant if you need NCSC-assured audit or risk work for a public-sector or defence body. (First DPO or AI policy, Regulated sectors)
- [CBIZ Pivot Point Security](https://theassurancedesk.com/advisers/cbiz-pivot-point-security.md): Advisory firm. Relevant if you want an outsourced security chief with published monthly prices, or help towards ISO 27001. (Seeking ISO 42001 certification, Regulated sectors, First DPO or AI policy)
- [Compass IT Compliance, LLC](https://theassurancedesk.com/advisers/compass-it-compliance.md): Advisory firm. Relevant if you want help preparing for SOC 2, PCI DSS or CMMC from named practice leads. (Seeking ISO 42001 certification, Regulated sectors, First DPO or AI policy)
- [Core Business Solutions](https://theassurancedesk.com/advisers/core-business-solutions.md): Advisory firm. Relevant if you are preparing for a first SOC 2 or ISO 27001 audit and want named consultants. (Seeking ISO 42001 certification)
- [Cyber Defense Group](https://theassurancedesk.com/advisers/cyber-defense-group.md): Advisory firm. Relevant if you are a growing company that wants a part-time security leader and help preparing for audits. (Seeking ISO 42001 certification, Regulated sectors, First DPO or AI policy, After a ransomware or security incident)
- [CyPro](https://theassurancedesk.com/advisers/cypro.md): Advisory firm. Relevant if you want cyber security and GDPR work together from named founders with checkable credentials. (First DPO or AI policy, Seeking ISO 42001 certification, Regulated sectors)
- [Data GRC Ltd](https://theassurancedesk.com/advisers/data-grc.md): Advisory firm. Relevant if you want a 30-minute advice call at a fixed price before committing to a retainer. (First DPO or AI policy, Seeking ISO 42001 certification, After a breach or ICO contact)
- [Data Privacy & Security Advisors, LLC (The DPSA)](https://theassurancedesk.com/advisers/data-privacy-security-advisors-dpsa.md): Advisory firm. Relevant if you need an outsourced US privacy contact for CCPA/CPRA, HIPAA and state privacy laws. (First DPO or AI policy, Regulated sectors)
- [Data Protection People](https://theassurancedesk.com/advisers/data-protection-people.md): Advisory firm. Relevant if you want DPO support and subject access request handling from one firm with named staff. (First DPO or AI policy, Seeking ISO 42001 certification, After a breach or ICO contact, Regulated sectors)
- [DataGuard](https://theassurancedesk.com/advisers/dataguard.md): Advisory firm. Relevant if you want software with consultants attached for ISO 27001 or several frameworks at once. (First DPO or AI policy, Seeking ISO 42001 certification, Exposed to the EU AI Act)
- [DCI Consulting Group, Inc.](https://theassurancedesk.com/advisers/dci-consulting-group.md): Advisory firm. Relevant if you use an AI hiring tool and need a bias audit under a specific law. (Exposed to the EU AI Act, Regulated sectors)
- [Debbie Reynolds Consulting LLC](https://theassurancedesk.com/advisers/debbie-reynolds-consulting-llc.md): Advisory firm. Relevant if you want a first conversation about privacy or AI governance risk with one named practitioner. (First DPO or AI policy, After a breach or ICO contact)
- [Deloitte LLP](https://theassurancedesk.com/advisers/deloitte-llp-uk.md): Advisory firm. Relevant if you are a large organisation with EU AI Act duties and want a named privacy partner. (Exposed to the EU AI Act, First DPO or AI policy)
- [DPO-Service](https://theassurancedesk.com/advisers/dpo-service.md): Advisory firm. Relevant if you want a DPO within 48 hours on a 30-day rolling contract. (First DPO or AI policy, After a breach or ICO contact, Switching provider)
- [Elevate Consult](https://theassurancedesk.com/advisers/elevate-consult.md): Advisory firm. Relevant if you are preparing for ISO 42001 or a New York City hiring-tool bias audit. (Seeking ISO 42001 certification, Exposed to the EU AI Act)
- [Enterprivacy Consulting Group](https://theassurancedesk.com/advisers/enterprivacy-consulting-group.md): Advisory firm. Relevant if you want a privacy-by-design review done personally by a named, qualified privacy specialist. (First DPO or AI policy, Seeking ISO 42001 certification)
- [Eticas.ai (Algorithmic Auditing Inc., US entity of Eticas Research and Consulting S.L.)](https://theassurancedesk.com/advisers/eticas-ai.md): Advisory firm. Relevant if you want an outside audit of a specific AI system, such as a hiring tool. (First DPO or AI policy, Exposed to the EU AI Act, Regulated sectors)
- [Evalian](https://theassurancedesk.com/advisers/evalian.md): Advisory firm. Relevant if you want data protection, cyber security and ISO support from one firm with named, qualified leaders. (First DPO or AI policy, Seeking ISO 42001 certification, Exposed to the EU AI Act, After a breach or ICO contact, After a ransomware or security incident)
- [EY (UK), Ernst & Young LLP](https://theassurancedesk.com/advisers/ey-llp-uk.md): Advisory firm. Relevant if you need AI governance advice from a mixed team of lawyers, risk experts and data scientists. (Exposed to the EU AI Act)
- [Fast Data Science](https://theassurancedesk.com/advisers/fast-data-science.md): Advisory firm. Relevant if you need hands-on AI delivery with governance advice built in, not a DPO. (First DPO or AI policy, Regulated sectors)
- [Fieldfisher LLP](https://theassurancedesk.com/advisers/fieldfisher-llp-uk.md): Advisory firm. Relevant if you want regulated solicitors whose data protection team has run a High Court claim. (Exposed to the EU AI Act, First DPO or AI policy)
- [Forvis Mazars](https://theassurancedesk.com/advisers/forvis-mazars.md): Advisory firm. Relevant if you want privacy and AI governance advice from a large firm that names its indemnity insurer. (First DPO or AI policy, Exposed to the EU AI Act, After a breach or ICO contact, Regulated sectors)
- [Fractional CISO, LLC](https://theassurancedesk.com/advisers/fractional-ciso.md): Advisory firm. Relevant if you are preparing for a SOC 2 or ISO 27001 audit and want named, qualified staff. (Seeking ISO 42001 certification, First DPO or AI policy, Regulated sectors)
- [GDPR Advisor (PSA Professional Solutions)](https://theassurancedesk.com/advisers/gdpr-advisor.md): Advisory firm. Relevant if you want an outsourced DPO and training from one firm, and will check its company number. (First DPO or AI policy, Seeking ISO 42001 certification, After a breach or ICO contact, Regulated sectors)
- [Gowling WLG (UK) LLP](https://theassurancedesk.com/advisers/gowling-wlg-uk-llp.md): Advisory firm. Relevant if you want data protection and AI lawyers who publish how they use AI themselves. (Regulated sectors, Exposed to the EU AI Act, After a breach or ICO contact)
- [GRCI Law](https://theassurancedesk.com/advisers/grci-law.md): Advisory firm. Relevant if you want data protection help alongside a group's wider cyber and ISO 27001 services. (First DPO or AI policy, After a breach or ICO contact)
- [Handley Gill](https://theassurancedesk.com/advisers/handley-gill.md): Advisory firm. Relevant if you need data protection and AI governance support, including information-rights tribunal appeals. (First DPO or AI policy, After a breach or ICO contact, Exposed to the EU AI Act, Regulated sectors)
- [HewardMills](https://theassurancedesk.com/advisers/hewardmills.md): Advisory firm. Relevant if you need an outsourced DPO across several countries from a firm that sells no software. (First DPO or AI policy, After a breach or ICO contact, Regulated sectors)
- [Hope & May](https://theassurancedesk.com/advisers/hope-and-may.md): Advisory firm. Relevant if you run a charity and want a named DPO team from an NCVO trusted supplier. (First DPO or AI policy, Regulated sectors, After a breach or ICO contact, Exposed to the EU AI Act)
- [IT Governance (now GRC Solutions)](https://theassurancedesk.com/advisers/it-governance.md): Advisory firm. Relevant if you want advice and ready-made compliance documents from one supplier, with published product prices. (Seeking ISO 42001 certification, First DPO or AI policy, Exposed to the EU AI Act, After a breach or ICO contact, After a ransomware or security incident)
- [JBW Group International, LLC](https://theassurancedesk.com/advisers/jbw-group-international-llc.md): Advisory firm. Relevant if you run a regulated US business and want named, qualified people for privacy or ISO work. (First DPO or AI policy, Seeking ISO 42001 certification, Regulated sectors)
- [JVR Consultancy](https://theassurancedesk.com/advisers/jvr-consultancy.md): Advisory firm. Relevant if you want UK GDPR help alongside rail, construction or utilities accreditation work. (First DPO or AI policy, Seeking ISO 42001 certification, Regulated sectors)
- [Kafico](https://theassurancedesk.com/advisers/kafico.md): Advisory firm. Relevant if you run a GP practice or health business and want a named, qualified DPO. (First DPO or AI policy, Seeking ISO 42001 certification, Regulated sectors)
- [Kemp IT Law LLP](https://theassurancedesk.com/advisers/kemp-it-law-llp.md): Advisory firm. Relevant if you need a regulated lawyer on the EU AI Act or UK data protection law. (Exposed to the EU AI Act, Regulated sectors)
- [KPMG LLP (UK)](https://theassurancedesk.com/advisers/kpmg-llp-uk.md): Advisory firm. Relevant if you already use Microsoft Purview and want AI-risk and data protection work from one firm. (Exposed to the EU AI Act, After a breach or ICO contact, Regulated sectors)
- [Kuma (Kimble and Associates, LLC)](https://theassurancedesk.com/advisers/kuma.md): Advisory firm. Relevant if you run a US public body and want a named, qualified part-time privacy officer. (First DPO or AI policy, Regulated sectors)
- [Logiq Consulting Ltd](https://theassurancedesk.com/advisers/logiq-consulting.md): Advisory firm. Relevant if you are a public body buying through G-Cloud and need NCSC-assured cyber audit work. (Regulated sectors, First DPO or AI policy)
- [Meditology Services, LLC](https://theassurancedesk.com/advisers/meditology-services.md): Advisory firm. Relevant if you are a US health organisation needing a HITRUST assessment or HIPAA compliance help. (Seeking ISO 42001 certification, Regulated sectors, After a breach or ICO contact)
- [Mishcon de Reya LLP](https://theassurancedesk.com/advisers/mishcon-de-reya-llp.md): Advisory firm. Relevant if you face a cyber incident, or want an outsourced DPO from a law firm. (After a breach or ICO contact, First DPO or AI policy, After a ransomware or security incident)
- [ORCAA (O'Neil Risk Consulting and Algorithmic Auditing, Inc.)](https://theassurancedesk.com/advisers/orcaa.md): Advisory firm. Relevant if you need a bias audit under New York City's Local Law 144 or Colorado's SB21-169. (Regulated sectors)
- [Osborne Clarke LLP](https://theassurancedesk.com/advisers/osborne-clarke-llp.md): Advisory firm. Relevant if you need solicitors for an ICO crisis, a subject access dispute or an AI rollout. (After a breach or ICO contact, Seeking ISO 42001 certification, Exposed to the EU AI Act)
- [Pembroke Privacy](https://theassurancedesk.com/advisers/pembroke-privacy.md): Advisory firm. Relevant if you need one adviser for EU and UK GDPR work and want named, qualified staff. (First DPO or AI policy, Exposed to the EU AI Act, After a breach or ICO contact)
- [PricewaterhouseCoopers LLP (PwC UK)](https://theassurancedesk.com/advisers/pricewaterhousecoopers-llp-uk.md): Advisory firm. Relevant if you want a Big Four firm that names its insurer and lists ISO 27701 certification. (Exposed to the EU AI Act, Regulated sectors)
- [Privacy Ref, Inc.](https://theassurancedesk.com/advisers/privacy-ref.md): Advisory firm. Relevant if you want a small US firm for privacy or AI governance work, not a large one. (First DPO or AI policy, Regulated sectors)
- [Red Clover Advisors, LLC](https://theassurancedesk.com/advisers/red-clover-advisors.md): Advisory firm. Relevant if you want help building a US privacy or AI governance programme, not incident response. (First DPO or AI policy, Regulated sectors)
- [Resolution Economics LLC](https://theassurancedesk.com/advisers/resolution-economics.md): Advisory firm. Relevant if you need a bias audit under New York City's Local Law 144 in the US. (Regulated sectors)
- [Responsible Artificial Intelligence LLC (RAI LLC)](https://theassurancedesk.com/advisers/rai-llc.md): Advisory firm. Relevant if you need a New York City Local Law 144 audit or an AI expert witness. (Regulated sectors)
- [Rhymetec LLC](https://theassurancedesk.com/advisers/rhymetec.md): Advisory firm. Relevant if your SaaS company needs SOC 2, ISO 27001 and a virtual CISO from one firm. (Seeking ISO 42001 certification, First DPO or AI policy, Regulated sectors)
- [RightCue Consulting Services Ltd](https://theassurancedesk.com/advisers/rightcue.md): Advisory firm. Relevant if you are a small firm seeking Cyber Essentials or appointing a first virtual CISO. (Seeking ISO 42001 certification, Regulated sectors, First DPO or AI policy, After a ransomware or security incident)
- [Rocket-Hire LLC](https://theassurancedesk.com/advisers/rocket-hire.md): Advisory firm. Relevant if you need a bias audit of an automated hiring tool and want the starting price upfront. (Regulated sectors, First DPO or AI policy)
- [RPC (Reynolds Porter Chamberlain LLP)](https://theassurancedesk.com/advisers/rpc-reynolds-porter-chamberlain.md): Advisory firm. Relevant if you face a data breach or regulator's investigation and want a regulated law firm. (After a breach or ICO contact, Exposed to the EU AI Act, After a ransomware or security incident)
- [Samurai Digital Security Limited](https://theassurancedesk.com/advisers/samurai-digital-security-limited.md): Advisory firm. Relevant if you are appointing a first virtual CISO or working towards ISO 27001 or Cyber Essentials. (First DPO or AI policy, Seeking ISO 42001 certification, After a breach or ICO contact, After a ransomware or security incident)
- [Securys](https://theassurancedesk.com/advisers/securys.md): Advisory firm. Relevant if you want a fixed-fee DPO with breach response and subject access requests included. (First DPO or AI policy, Exposed to the EU AI Act, After a breach or ICO contact, Regulated sectors)
- [SideChannel, Inc.](https://theassurancedesk.com/advisers/sidechannel.md): Advisory firm. Relevant if you want a virtual CISO or SOC 2 readiness help and a published price range. (Seeking ISO 42001 certification, First DPO or AI policy)
- [SME Comply](https://theassurancedesk.com/advisers/sme-comply.md): Advisory firm. Relevant if you run a small business and want DPO support and legal advice from one place. (First DPO or AI policy, After a breach or ICO contact, Exposed to the EU AI Act)
- [Strategic Management Services, LLC](https://theassurancedesk.com/advisers/strategic-management-services.md): Advisory firm. Relevant if you run a US healthcare organisation and need an interim HIPAA privacy officer or breach help. (After a breach or ICO contact, Regulated sectors, First DPO or AI policy)
- [The DPO Centre](https://theassurancedesk.com/advisers/dpo-centre.md): Advisory firm. Relevant if you are appointing a first DPO and want named, qualified people and sector case studies. (First DPO or AI policy, Exposed to the EU AI Act, Regulated sectors, Seeking ISO 42001 certification)
- [URM Consulting](https://theassurancedesk.com/advisers/urm-consulting.md): Advisory firm. Relevant if you want DPO support and ISO 27001 or 22301 certification help from one firm. (First DPO or AI policy, Seeking ISO 42001 certification, Regulated sectors, Exposed to the EU AI Act, After a ransomware or security incident)
- [vCISO Services, LLC](https://theassurancedesk.com/advisers/vciso-services.md): Advisory firm. Relevant if you are a smaller US business preparing for SOC 2, ISO 27001 or CMMC audits. (Seeking ISO 42001 certification, First DPO or AI policy, Regulated sectors)
- [VeraSafe, LLC](https://theassurancedesk.com/advisers/verasafe.md): Advisory firm. Relevant if you need an outsourced DPO or advice on California privacy law or the EU AI Act. (First DPO or AI policy, Exposed to the EU AI Act)
- [Winston Taylor UK LLP (formerly Taylor Wessing)](https://theassurancedesk.com/advisers/winston-taylor-uk.md): Advisory firm. Relevant if you face a breach, regulator inquiry or EU AI Act question and want a law firm. (After a breach or ICO contact, Exposed to the EU AI Act, Regulated sectors)
- [Zaviant (WJS Cyber Consulting, LLC d/b/a Zaviant)](https://theassurancedesk.com/advisers/zaviant.md): Advisory firm. Relevant if you are a US company building a privacy programme on OneTrust or a similar platform. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Regulated sectors)

## Certification bodies (33)

They audit you against a standard, such as ISO/IEC 27001 or ISO/IEC 42001, and issue a certificate or an audit report.

- [360 Advanced, Inc.](https://theassurancedesk.com/advisers/360-advanced.md): Certification body. Relevant if you need a SOC 2 examination and work in US finance, healthcare or government. (Seeking ISO 42001 certification, Regulated sectors)
- [A-LIGN Compliance and Security, Inc. (dba A-LIGN)](https://theassurancedesk.com/advisers/a-lign.md): Certification body. Relevant if you want one accredited body to certify security, privacy, continuity and AI management systems. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [Amtivo](https://theassurancedesk.com/advisers/amtivo.md): Certification body. Relevant if you want UKAS-accredited ISO 9001, ISO 27001 or ISO 45001 certification, not ISO 42001. (First DPO or AI policy, Seeking ISO 42001 certification, Switching provider, Regulated sectors)
- [Approachable Certification Ltd](https://theassurancedesk.com/advisers/approachable-certification.md): Certification body. Relevant if you want ISO/IEC 27001 certification from a body that says it has never offered consultancy. (Seeking ISO 42001 certification)
- [Aprio, LLP](https://theassurancedesk.com/advisers/aprio-llp.md): Certification body. Relevant if you want ISO/IEC 42001 or 27001 certification from a large, ANAB-accredited US firm. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [BARR Certifications, LLC](https://theassurancedesk.com/advisers/barr-certifications.md): Certification body. Relevant if you run a US organisation and need ANAB-accredited ISO/IEC 27001 or 27701 certification. (Seeking ISO 42001 certification)
- [Boulay Certifications, LLC](https://theassurancedesk.com/advisers/boulay-certifications.md): Certification body. Relevant if you need ISO/IEC 27001 certification and want written rules separating audit from consulting. (Seeking ISO 42001 certification)
- [BSI (The British Standards Institution)](https://theassurancedesk.com/advisers/bsi.md): Certification body. Relevant if you want UKAS-accredited ISO/IEC 42001 certification and a certificate anyone can check online. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [Bureau Veritas](https://theassurancedesk.com/advisers/bureau-veritas.md): Certification body. Relevant if you need UKAS-accredited ISO 27001, ISO 9001 or nuclear supply-chain certification, not ISO 42001. (First DPO or AI policy, Seeking ISO 42001 certification, Switching provider, Regulated sectors)
- [Centre for Assessment](https://theassurancedesk.com/advisers/centre-for-assessment.md): Certification body. Relevant if you want UKAS-accredited ISO 9001 or 27001 certification, or a Lexcel assessment for a law firm. (First DPO or AI policy, Seeking ISO 42001 certification, Switching provider, Regulated sectors)
- [Coalfire Certification, Inc.](https://theassurancedesk.com/advisers/coalfire-certification.md): Certification body. Relevant if you want ISO 42001 certification from a body that has already certified named technology firms. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [ControlCase Assessments LLC](https://theassurancedesk.com/advisers/controlcase-assessments.md): Certification body. Relevant if you need PCI DSS, FedRAMP, CMMC or HITRUST assessments from one firm. (Seeking ISO 42001 certification, Regulated sectors)
- [DNV](https://theassurancedesk.com/advisers/dnv.md): Certification body. Relevant if you need UKAS-accredited ISO 9001, ISO 27001 or ISO 45001 certification from a large international group. (First DPO or AI policy, Seeking ISO 42001 certification, Switching provider, Regulated sectors)
- [EAGLE Registrations Inc.](https://theassurancedesk.com/advisers/eagle-registrations.md): Certification body. Relevant if you want an ANAB-accredited ISO/IEC 27001 certificate from a body that sells no consulting. (Seeking ISO 42001 certification, Regulated sectors)
- [Forefront Certification Limited (FFC)](https://theassurancedesk.com/advisers/forefront-certification-limited.md): Certification body. Relevant if you want UKAS-accredited ISO 27001 certification for a UK organisation. (Seeking ISO 42001 certification)
- [Intertek](https://theassurancedesk.com/advisers/intertek.md): Certification body. Relevant if you need a UKAS-accredited ISO 27001, ISO 9001 or ISO 37001 certificate from a large group. (First DPO or AI policy, Seeking ISO 42001 certification, Switching provider, Regulated sectors)
- [IS Partners, LLC](https://theassurancedesk.com/advisers/is-partners.md): Certification body. Relevant if you need an ANAB-accredited ISO 27001 certificate or a CMMC assessment in the US. (Seeking ISO 42001 certification, Regulated sectors)
- [ISOQAR (formerly Alcumus ISOQAR)](https://theassurancedesk.com/advisers/isoqar.md): Certification body. Relevant if you want a UKAS-accredited ISO 42001 certificate, audited alongside ISO 9001 or ISO 27001. (Seeking ISO 42001 certification, Exposed to the EU AI Act, First DPO or AI policy)
- [Kompleye Attestation, LLC](https://theassurancedesk.com/advisers/kompleye-attestation.md): Certification body. Relevant if you need an accredited ISO 27001 or 27701 certificate and SOC work from one firm. (Seeking ISO 42001 certification, Regulated sectors)
- [Linford & Company LLP](https://theassurancedesk.com/advisers/linford-and-company-llp.md): Certification body. Relevant if you need SOC 2, US HIPAA or FedRAMP Moderate assessments from one firm. (Seeking ISO 42001 certification, Regulated sectors)
- [LRQA](https://theassurancedesk.com/advisers/lrqa.md): Certification body. Relevant if you want accredited ISO 42001 certification combined with ISO 27001, 9001 or 14001 audits. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [NQA](https://theassurancedesk.com/advisers/nqa.md): Certification body. Relevant if you want accredited ISO 42001 certification with the contract terms published before you sign. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Switching provider)
- [Palindrome Technologies, Inc.](https://theassurancedesk.com/advisers/palindrome-technologies.md): Certification body. Relevant if you want ISO/IEC 42001 certification from an ANAB-accredited body. (Seeking ISO 42001 certification, Regulated sectors)
- [Peers Quality Assurance Limited (PQAL)](https://theassurancedesk.com/advisers/peers-quality-assurance-pqal.md): Certification body. Relevant if you want UKAS-accredited ISO/IEC 27001 certification and published rules on auditor impartiality. (Seeking ISO 42001 certification, Regulated sectors)
- [Perry Johnson Registrars, Inc.](https://theassurancedesk.com/advisers/perry-johnson-registrars.md): Certification body. Relevant if you need certification to an established standard such as ISO 9001 or ISO 27001. (Seeking ISO 42001 certification, Regulated sectors, Exposed to the EU AI Act)
- [RA Cert Ltd](https://theassurancedesk.com/advisers/ra-cert-ltd.md): Certification body. Relevant if you want UKAS-accredited ISO/IEC 27001 certification or a World Lottery Association security assessment. (Seeking ISO 42001 certification, Regulated sectors)
- [Responsible AI Institute (Responsible Artificial Intelligence Institute)](https://theassurancedesk.com/advisers/responsible-ai-institute.md): Certification body. Relevant if you work in finance or health and want an AI governance assessment with published prices. (Seeking ISO 42001 certification, Regulated sectors)
- [Schellman Compliance, LLC](https://theassurancedesk.com/advisers/schellman-compliance.md): Certification body. Relevant if you want ISO 42001 or ISO 27001 certification and also face US FedRAMP or CMMC rules. (Seeking ISO 42001 certification, Regulated sectors)
- [Sensiba LLP](https://theassurancedesk.com/advisers/sensiba-llp.md): Certification body. Relevant if you want ISO 27001 or ISO 42001 certification and a SOC 2 report from one firm. (Seeking ISO 42001 certification)
- [SGS North America Inc.](https://theassurancedesk.com/advisers/sgs-north-america.md): Certification body. Relevant if you need ISO 27001 or ISO 42001 certification in the US from a large certifier. (Seeking ISO 42001 certification)
- [SGS United Kingdom Limited](https://theassurancedesk.com/advisers/sgs.md): Certification body. Relevant if you want UKAS-accredited ISO 27001 certification, with ISO 27701 privacy certification from the same body. (Seeking ISO 42001 certification)
- [Socotec Certification United Kingdom Limited](https://theassurancedesk.com/advisers/socotec-certification-uk.md): Certification body. Relevant if you want UKAS-accredited ISO 27001 certification and do not need ISO 42001. (Seeking ISO 42001 certification)
- [TÜV UK Limited (TÜV NORD Group)](https://theassurancedesk.com/advisers/tuv-uk.md): Certification body. Relevant if you want an ISO 42001 certificate from a UKAS-accredited body that says it does not consult. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors, Switching provider)

## Software products (27)

Tools you subscribe to for privacy, security or AI governance work, such as managing cookie consent, tracking compliance or monitoring AI models.

- [Advai](https://theassurancedesk.com/advisers/advai.md): Software product. Relevant if you need test and monitoring evidence for a high-risk AI system in a regulated sector. (Exposed to the EU AI Act, Regulated sectors, Seeking ISO 42001 certification)
- [Arthur AI](https://theassurancedesk.com/advisers/arthur-ai.md): Software product. Relevant if you already run AI agents and want software to monitor them and log what they do. (Exposed to the EU AI Act, Regulated sectors)
- [BigID](https://theassurancedesk.com/advisers/bigid.md): Software product. Relevant if you are in a regulated sector and want software, not advice, to find and classify data. (Regulated sectors, Exposed to the EU AI Act)
- [CookieYes](https://theassurancedesk.com/advisers/cookieyes.md): Software product. Relevant if you want a self-serve cookie banner with published monthly prices and a free plan to start. (First DPO or AI policy)
- [Credo AI](https://theassurancedesk.com/advisers/credo-ai.md): Software product. Relevant if you need software to track your AI systems against the EU AI Act or ISO 42001. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Regulated sectors, Switching provider)
- [Drata](https://theassurancedesk.com/advisers/drata.md): Software product. Relevant if you want software that links AI risks to controls, owners and evidence for ISO 42001. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Switching provider)
- [Enzai](https://theassurancedesk.com/advisers/enzai.md): Software product. Relevant if you want UK software to register, assess and monitor your AI systems. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Switching provider)
- [Fiddler AI](https://theassurancedesk.com/advisers/fiddler-ai.md): Software product. Relevant if you want AI governance software with a free tier and a published per-trace price. (Regulated sectors, Exposed to the EU AI Act)
- [Hicomply](https://theassurancedesk.com/advisers/hicomply.md): Software product. Relevant if you want compliance software with prices on the website before you speak to sales. (Seeking ISO 42001 certification, Exposed to the EU AI Act, First DPO or AI policy)
- [Holistic AI](https://theassurancedesk.com/advisers/holistic-ai.md): Software product. Relevant if you want one tool to list your AI systems and map them to several frameworks. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Switching provider)
- [Hyperproof](https://theassurancedesk.com/advisers/hyperproof.md): Software product. Relevant if you manage several frameworks and want one place for audit evidence. (Seeking ISO 42001 certification, Regulated sectors)
- [IBM watsonx.governance](https://theassurancedesk.com/advisers/ibm-watsonx-governance.md): Software product. Relevant if you use IBM's watsonx and want audit records for AI models, with a published starting price. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Regulated sectors, Switching provider)
- [ISMS.online](https://theassurancedesk.com/advisers/isms-online.md): Software product. Relevant if you already run ISO 27001 and want to add ISO 42001 on the same platform. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [LogicGate](https://theassurancedesk.com/advisers/logicgate.md): Software product. Relevant if your team runs its own risk, compliance and AI oversight work and needs software for it. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [Metomic](https://theassurancedesk.com/advisers/metomic.md): Software product. Relevant if you need to see and stop sensitive data going into AI tools across your apps. (Exposed to the EU AI Act, Regulated sectors, After a breach or ICO contact)
- [Microsoft Purview](https://theassurancedesk.com/advisers/microsoft-purview.md): Software product. Relevant if you already use Microsoft 365 E3 or E5 and want controls on data sent to AI. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Regulated sectors)
- [Monitaur](https://theassurancedesk.com/advisers/monitaur.md): Software product. Relevant if you are an insurer or financial firm wanting software to track AI model controls and evidence. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Regulated sectors)
- [OneTrust AI Governance](https://theassurancedesk.com/advisers/onetrust-ai-governance.md): Software product. Relevant if you already use OneTrust for privacy and want AI governance in the same platform. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Regulated sectors, Switching provider)
- [Osano](https://theassurancedesk.com/advisers/osano.md): Software product. Relevant if you want self-service cookie consent software with published starter prices and a dated SOC 2 report. (First DPO or AI policy, After a breach or ICO contact)
- [Saidot](https://theassurancedesk.com/advisers/saidot.md): Software product. Relevant if you need software to classify AI systems by risk and document EU AI Act conformity. (Exposed to the EU AI Act, Seeking ISO 42001 certification)
- [Secureframe](https://theassurancedesk.com/advisers/secureframe.md): Software product. Relevant if you want ISO 42001 software on the same platform as SOC 2 and ISO 27001. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Switching provider)
- [Strike Graph](https://theassurancedesk.com/advisers/strike-graph.md): Software product. Relevant if you want to run SOC 2 or ISO 27001 compliance yourself and know the price upfront. (Seeking ISO 42001 certification, Regulated sectors, Exposed to the EU AI Act, Switching provider)
- [SureCloud](https://theassurancedesk.com/advisers/surecloud.md): Software product. Relevant if you already use SureCloud and want to add EU AI Act risk classification. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Regulated sectors)
- [Thoropass](https://theassurancedesk.com/advisers/thoropass.md): Software product. Relevant if you want one tool to hold your SOC 2, ISO 27001 and ISO 42001 evidence. (Seeking ISO 42001 certification, Regulated sectors)
- [Trilateral Research](https://theassurancedesk.com/advisers/trilateral-research.md): Software product. Relevant if you buy through Crown Commercial Service and want data protection and AI governance together. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Regulated sectors)
- [Trustible](https://theassurancedesk.com/advisers/trustible.md): Software product. Relevant if you need a register of your AI uses, triaged by risk, for the EU AI Act. (Exposed to the EU AI Act, Seeking ISO 42001 certification, Regulated sectors)
- [Vanta](https://theassurancedesk.com/advisers/vanta.md): Software product. Relevant if you want SOC 2 or ISO 42001 evidence collected automatically, with a published uptime commitment. (Seeking ISO 42001 certification, Exposed to the EU AI Act, Switching provider)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.