ISO 42001 in the UK: who certifies you, and what does it cost?

What is ISO/IEC 42001?

ISO/IEC 42001 is the international standard for an AI management system: how an organisation runs its use of AI through policies, roles, risks and controls. It sets the requirements to establish, implement, maintain and continually improve that system. ISO and the IEC published it in December 2023, and it is the first edition.

It is for organisations of any size that develop, provide or use AI-based products or services, in any industry and in the public sector. So it covers the firm that builds AI and the firm whose staff only use tools such as ChatGPT.

It is a standard, not a law. No UK law requires it, and the UK has no AI Act (our guide to how the UK regulates AI). A customer or a tender may still ask for it. Readers with a United Kingdom billing address buy the standard from the BSI store.

Which certification bodies are accredited for ISO 42001 in the UK?

Five UK certification bodies are accredited by UKAS for ISO/IEC 42001: BSI Assurance UK, ISOQAR, LRQA, NQA and TÜV UK. We searched the UKAS directory for ISO/IEC 42001 on 5 October 2026 and read each body's schedule of accreditation. UKAS is the UK's national accreditation body. BSI was the first it accredited for the standard, in January 2026.

Each of the five is accredited under two standards for certification bodies. ISO/IEC 17021-1 covers every management system. ISO/IEC 42006, published in July 2025, adds requirements for bodies that audit and certify AI management systems.

Each schedule also lists the AI roles the body may certify, such as a developer, which builds AI, or a user, which uses it. Check that the roles your organisation plays are on the list. LRQA's schedule lists three roles and does not list producer.

The same search also returns PECB. Its UKAS accreditation is to certify people as ISO/IEC 42001 lead implementers and lead auditors, not to certify organisations.

On this site, 33 of the 140 providers are certification bodies, and each profile records what its UKAS schedule showed on the date we read it.

Consultant or certification body: who does what?

A consultant helps you build your AI management system. A certification body audits it and issues the certificate. For an accredited certificate, the certification body may not also offer consultancy on management systems.

So the help to prepare comes from your own team or from a firm that is not your certification body. If one group offers both, ask which company issues the certificate and under which accreditation. The page on getting certified lists the providers on this site that work on ISO certification.

How does ISO 42001 certification work?

ISO 42001 certification starts with an audit in two stages, then one audit a year, and the certificate lasts three years. NQA, one of the five accredited bodies, says your system must have run for at least three months first, with a management review and a full cycle of internal audits.

NQA describes the first audit as two mandatory visits. It says the certificate is kept through surveillance audits in years one and two, and a recertification audit in year three.

The yearly audit is a rule for every accredited body. Under ISO/IEC 17021-1 there must be an audit, either surveillance or recertification, at least once in each calendar year.

How much does ISO 42001 certification cost a small company?

ISO 42001 certification has no published price to compare in the UK. None of the five UKAS accredited bodies shows a certification price on its certification page, so the cost for your company comes from a quote.

Ask for a quote that covers all three years: the two-stage initial audit, the surveillance audits in years one and two, and the recertification audit in year three.

The certificate is one part of the cost. The others are the standard itself, the time your own team spends building and running the system, and any outside help to prepare.

The one ISO 42001 price we found on the five bodies' websites was for training, not certification. ISOQAR lists its ISO/IEC 42001 internal auditor course at £920, with VAT added at checkout.

How do you check an ISO 42001 certificate is genuine?

To check an ISO 42001 certificate, find the certification body named on it in the UKAS directory, and read its schedule for ISO/IEC 42001. If the standard is not on the schedule, the certificate is not UKAS accredited.

Then look for the certificate itself in UKAS CertCheck, a free and public tool for checking claims of UKAS accredited certification. Check the name of the organisation and the dates. A certificate lasts three years, with an audit every year.

A person's certificate is a different thing. A course that makes someone an ISO/IEC 42001 lead auditor shows what that person has learned. It is not a certificate for an organisation.

What do AI engines cite on ISO 42001?

When The Assurance Desk asked six AI engines six questions about ISO 42001 in the UK on 18 September 2026, their 36 answers cited 284 links from 102 websites. Seven answers linked to UKAS, which publishes the list of accredited bodies. No answer linked to ISOQAR, one of the five accredited bodies.

We asked each question once, from the UK with web search on, of OpenAI GPT-4o, Microsoft Copilot, Google Gemini 2.5 Flash, Google AI Mode, Google AI Overviews and Perplexity. The questions were the ones a buyer might type, about who can certify you, what it costs, and who can help you prepare.

Four of the six questions got no link to UKAS in any answer: the question on cost, the two on preparation, and the one on consultants and certification bodies. This was one run on one day, and AI answers change.

To check who is accredited, go to the UKAS directory itself.

What to do

1. Ask the customer or the tender exactly what it wants: ISO/IEC 42001 certification, and whether the certificate must be UKAS accredited.
2. Decide which AI roles your organisation plays, such as developer or user, and check that the body's UKAS schedule covers them.
3. Decide who helps you prepare, if anyone. It cannot be the body that will certify you.
4. Run the system for at least three months, with a management review and a full cycle of internal audits, before the first audit.
5. Ask accredited bodies for a quote that covers all three years, and compare them on the same basis.
6. Once you hold the certificate, check that it shows in UKAS CertCheck.

Common questions

Is ISO 42001 a legal requirement in the UK?

No. ISO/IEC 42001 is a standard, and no UK law requires it. A customer or a tender may ask for it, and then it is a condition of that contract. For the laws that do cover AI in the UK, see how the UK regulates AI.

We already have ISO 27001. Do we need ISO 42001 as well?

Only if a customer, a tender or your own plans call for it. ISO 27001 is the standard for managing information security, and ISO 42001 is the standard for managing how you develop, provide or use AI, so one does not stand in for the other. See ISO 42001 or ISO 27001: which do you need, and which first?.

Does ISO 42001 certification show that our AI is safe?

Not on its own. ISO 42001 is about how your organisation manages AI: its policies, objectives and processes. ISO says that, rather than looking at the details of specific AI applications, the standard gives a way to manage AI risks and opportunities across an organisation. A certificate shows that an accredited body audited that management system.

Does ISO 42001 meet the EU AI Act?

The EU AI Act does not ask for ISO 42001 by name. Under Article 40 of the EU AI Act, a high-risk system that meets EU-approved standards counts as meeting the rules they cover, and Article 40 does not name ISO 42001. See what the EU AI Act asks of a UK business.

Can my ISO 27001 certification body also certify ISO 42001?

Only if its UKAS schedule lists ISO/IEC 42001. Accreditation is granted standard by standard, so a body accredited for ISO 27001 is not automatically accredited for ISO 42001. Read its schedule in the UKAS directory. See also ISO 27001 certification and who can certify you.

What about a certificate accredited outside the UK?

Some certification bodies that work in the UK hold ISO/IEC 42001 accreditation from another country. DNV holds it through the Dutch accreditation body, RvA, Bureau Veritas through Italy's Accredia, and Intertek through JAS-ANZ. Their UKAS schedules did not include ISO/IEC 42001 when we read them in July 2026, and the UKAS search on 5 October 2026 did not return them. If a customer asks for a UKAS accredited certificate, ask it whether it accepts others.

Where next

• Seeking ISO 42001 certification
• Exposed to the EU AI Act
• What does ISO 27001 certification take, and who can certify you?
• How does the UK regulate AI?
• Does your UK business need an AI policy, and what goes in it?
• Is there a qualification or certification for AI governance?

This is an independent editorial guide, not legal advice.