# ISO 42001 in the UK: who certifies you, and what does it cost? A certificate is worth what the body behind it is accredited to do, so check the body before you choose. The Assurance Desk. Published 5 October 2026. Last checked 7 October 2026. **The short answer.** In the UK, five certification bodies hold UKAS accreditation to certify ISO/IEC 42001: BSI, ISOQAR, LRQA, NQA and TÜV UK ([UKAS directory of accredited organisations, search for ISO/IEC 42001](https://www.ukas.com/find-an-organisation/?q=ISO%2FIEC+42001&type%5B%5D=279), checked 5 October 2026). None of the five publishes a price for certification, so the cost comes from a quote. The body that certifies you may not also help you prepare, so that work comes from your own team or a different firm ([European Accreditation](https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/), checked 5 October 2026). ## In this series - [ISO 42001 or ISO 27001: which do you need, and which first?](https://theassurancedesk.com/guides/iso-42001-or-iso-27001.md) ## What is ISO/IEC 42001? ISO/IEC 42001 is the international standard for an AI management system: how an organisation runs its use of AI through policies, roles, risks and controls. It sets the requirements to establish, implement, maintain and continually improve that system ([ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026). ISO and the IEC published it in December 2023, and it is the first edition. It is for organisations of any size that develop, provide or use AI-based products or services, in any industry and in the public sector ([ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026). So it covers the firm that builds AI and the firm whose staff only use tools such as ChatGPT. It is a standard, not a law. No UK law requires it, and the UK has no AI Act ([our guide to how the UK regulates AI](/guides/uk-ai-regulation)). A customer or a tender may still ask for it. Readers with a United Kingdom billing address buy the standard from the BSI store ([ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026). ## Which certification bodies are accredited for ISO 42001 in the UK? Five UK certification bodies are accredited by UKAS for ISO/IEC 42001: BSI Assurance UK, ISOQAR, LRQA, NQA and TÜV UK. We searched the UKAS directory for ISO/IEC 42001 on 5 October 2026 and read each body's schedule of accreditation ([UKAS directory of accredited organisations, search for ISO/IEC 42001](https://www.ukas.com/find-an-organisation/?q=ISO%2FIEC+42001&type%5B%5D=279), checked 5 October 2026). UKAS is the UK's national accreditation body. BSI was the first it accredited for the standard, in January 2026 ([UKAS, first accreditation for ISO/IEC 42001](https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/), checked 5 October 2026). Each of the five is accredited under two standards for certification bodies. ISO/IEC 17021-1 covers every management system. ISO/IEC 42006, published in July 2025, adds requirements for bodies that audit and certify AI management systems ([ISO, ISO/IEC 42006:2025](https://www.iso.org/standard/42006), checked 5 October 2026). Each schedule also lists the AI roles the body may certify, such as a developer, which builds AI, or a user, which uses it. Check that the roles your organisation plays are on the list. LRQA's schedule lists three roles and does not list producer. The same search also returns PECB. Its UKAS accreditation is to certify people as ISO/IEC 42001 lead implementers and lead auditors, not to certify organisations ([UKAS, schedule of accreditation 21923, PECB Group](https://www.ukas.com/download-schedule/21923/Personnel), checked 5 October 2026). On this site, 33 of the 140 providers are certification bodies, and each profile records what its UKAS schedule showed on the date we read it. **UK certification bodies accredited by UKAS for ISO/IEC 42001, in alphabetical order, read on 5 October 2026** | Certification body | UKAS number | Schedule issued | AI roles it may certify | | --- | --- | --- | --- | | [BSI Assurance UK Ltd](/advisers/bsi) | 0003 | 15 September 2026 | Developer, producer, provider, user | | [ISOQAR Limited](/advisers/isoqar) | 0026 | 4 June 2026 | Developer, producer, provider, user | | [LRQA Limited](/advisers/lrqa) | 0001 | 15 September 2026 | Developer, provider, user | | [NQA Certification Ltd](/advisers/nqa) | 0015 | 28 August 2026 | Developer, producer, provider, user | | [TÜV UK Limited](/advisers/tuv-uk) | 0065 | 8 June 2026 | Developer, producer, provider, user | Source: UKAS, schedule of accreditation 0003, BSI Assurance UK Ltd, https://www.ukas.com/download-schedule/0003/ManagementSystems (checked 5 October 2026); UKAS, schedule of accreditation 0026, ISOQAR Limited, https://www.ukas.com/download-schedule/0026/ManagementSystems (checked 5 October 2026); UKAS, schedule of accreditation 0001, LRQA Limited, https://www.ukas.com/download-schedule/0001/ManagementSystems (checked 5 October 2026); UKAS, schedule of accreditation 0015, NQA Certification Ltd, https://www.ukas.com/download-schedule/0015/ManagementSystems (checked 5 October 2026); UKAS, schedule of accreditation 0065, TUV UK Limited, https://www.ukas.com/download-schedule/0065/ManagementSystems (checked 5 October 2026) > "Accreditation to ISO/IEC 17021-1 confirms that a certification body has the competence, impartiality and consistent approach needed to certify organisations against this new standard." > UKAS, AI certification > UKAS, on its first accreditation for ISO/IEC 42001, 15 January 2026, https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/ (checked 5 October 2026) ## Consultant or certification body: who does what? A consultant helps you build your AI management system. A certification body audits it and issues the certificate. For an accredited certificate, the certification body may not also offer consultancy on management systems ([European Accreditation](https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/), checked 5 October 2026). So the help to prepare comes from your own team or from a firm that is not your certification body. If one group offers both, ask which company issues the certificate and under which accreditation. The page on [getting certified](/best/certification-seeking) lists the providers on this site that work on ISO certification. **Two jobs, two organisations** - **Consultant** - Helps you build and run the AI management system - Can be any firm, or your own team does the work - Does not issue the certificate - **Certification body** - Audits your system against ISO/IEC 42001 - Holds accreditation for the standard, in the UK from UKAS - May not also advise you on meeting it For an accredited ISO/IEC 42001 certificate, the firm that prepares you and the body that certifies you are separate. Source: European Accreditation, FAQ 41.1: impartiality, ISO/IEC 17021-1:2015 clause 5.2.5, https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/ (checked 5 October 2026); UKAS, first accreditation for ISO/IEC 42001, https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/ (checked 5 October 2026) ## How does ISO 42001 certification work? ISO 42001 certification starts with an audit in two stages, then one audit a year, and the certificate lasts three years. NQA, one of the five accredited bodies, says your system must have run for at least three months first, with a management review and a full cycle of internal audits ([NQA, ISO 42001 certification](https://www.nqa.com/en-gb/certification/standards/iso-42001), checked 5 October 2026). NQA describes the first audit as two mandatory visits. It says the certificate is kept through surveillance audits in years one and two, and a recertification audit in year three ([NQA, ISO 42001 certification](https://www.nqa.com/en-gb/certification/standards/iso-42001), checked 5 October 2026). The yearly audit is a rule for every accredited body. Under ISO/IEC 17021-1 there must be an audit, either surveillance or recertification, at least once in each calendar year ([European Accreditation, FAQ 37.12](https://european-accreditation.org/sp_accordion_faqs/question-37-12-iso-17021-12015-clause-9-1-3/), checked 5 October 2026). **How ISO/IEC 42001 certification runs** 1. Run the system: At least three months, with a management review and internal audits. 2. Stage 1: The first of two visits in the initial audit. 3. Stage 2: The second visit. The certificate follows if you meet the standard. 4. Surveillance audits: One in year one and one in year two. 5. Recertification: An audit in year three, which starts a new three-year cycle. From a system that runs to a certificate, then an audit every year. Source: NQA, ISO 42001 certification, https://www.nqa.com/en-gb/certification/standards/iso-42001 (checked 5 October 2026); European Accreditation, FAQ 37.12: ISO/IEC 17021-1:2015 clause 9.1.3, https://european-accreditation.org/sp_accordion_faqs/question-37-12-iso-17021-12015-clause-9-1-3/ (checked 5 October 2026) ## How much does ISO 42001 certification cost a small company? ISO 42001 certification has no published price to compare in the UK. None of the five UKAS accredited bodies shows a certification price on its certification page, so the cost for your company comes from a quote ([BSI](https://www.bsigroup.com/en-GB/products-and-services/standards/iso-42001-ai-management-system/), [ISOQAR](https://isoqar.com/get-a-quote/), [LRQA](https://www.lrqa.com/en-gb/iso-42001-ai-management-system-certification/), [NQA](https://www.nqa.com/en-gb/certification/standards/iso-42001) and [TÜV UK](https://www.tuv-nord.com/uk/en/services/management-systems-certification/), checked 5 October 2026). Ask for a quote that covers all three years: the two-stage initial audit, the surveillance audits in years one and two, and the recertification audit in year three ([NQA, ISO 42001 certification](https://www.nqa.com/en-gb/certification/standards/iso-42001), checked 5 October 2026). The certificate is one part of the cost. The others are the standard itself, the time your own team spends building and running the system, and any outside help to prepare. The one ISO 42001 price we found on the five bodies' websites was for training, not certification. ISOQAR lists its ISO/IEC 42001 internal auditor course at £920, with VAT added at checkout ([ISOQAR, AIMS ISO/IEC 42001:2023 internal auditor course](https://isoqar.com/parent-courses/aims-iso-iec-42001-2023-internal-auditor-course/), checked 5 October 2026). **Ask for the whole certification cycle in the quote** | Cost to ask about | What the quote should identify | | --- | --- | | Initial certification | The two-stage audit | | Keeping certification | Surveillance audits in years one and two | | Renewal | Recertification in year three | | Preparation | The standard, your team’s time and any outside help | Source: NQA, ISO 42001 certification, https://www.nqa.com/en-gb/certification/standards/iso-42001 (checked 5 October 2026) ## How do you check an ISO 42001 certificate is genuine? To check an ISO 42001 certificate, find the certification body named on it in the UKAS directory, and read its schedule for ISO/IEC 42001 ([UKAS directory of accredited organisations, search for ISO/IEC 42001](https://www.ukas.com/find-an-organisation/?q=ISO%2FIEC+42001&type%5B%5D=279), checked 5 October 2026). If the standard is not on the schedule, the certificate is not UKAS accredited. Then look for the certificate itself in UKAS CertCheck, a free and public tool for checking claims of UKAS accredited certification ([UKAS CertCheck](https://www.ukas.com/certcheck/), checked 5 October 2026). Check the name of the organisation and the dates. A certificate lasts three years, with an audit every year ([NQA, ISO 42001 certification](https://www.nqa.com/en-gb/certification/standards/iso-42001), checked 5 October 2026). A person's certificate is a different thing. A course that makes someone an ISO/IEC 42001 lead auditor shows what that person has learned. It is not a certificate for an organisation ([UKAS, schedule of accreditation 21923, PECB Group](https://www.ukas.com/download-schedule/21923/Personnel), checked 5 October 2026). ## What do AI engines cite on ISO 42001? When The Assurance Desk asked six AI engines six questions about ISO 42001 in the UK on 18 September 2026, their 36 answers cited 284 links from 102 websites. Seven answers linked to UKAS, which publishes the list of accredited bodies. No answer linked to ISOQAR, one of the five accredited bodies ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 5 October 2026). We asked each question once, from the UK with web search on, of OpenAI GPT-4o, Microsoft Copilot, Google Gemini 2.5 Flash, Google AI Mode, Google AI Overviews and Perplexity. The questions were the ones a buyer might type, about who can certify you, what it costs, and who can help you prepare ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 5 October 2026). Four of the six questions got no link to UKAS in any answer: the question on cost, the two on preparation, and the one on consultants and certification bodies. This was one run on one day, and AI answers change ([The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file)](https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json), checked 5 October 2026). To check who is accredited, go to the [UKAS directory](https://www.ukas.com/find-an-organisation/) itself. **Which sources the AI answers cited** - UKAS: 7 of 36 - BSI: 10 of 36 - ISOQAR: 0 of 36 - LRQA: 5 of 36 - NQA: 6 of 36 - TÜV UK: 2 of 36 Each bar counts the answers, among 36, that cited the source at least once. UKAS first, then the five accredited bodies in alphabetical order. Six AI engines, six questions on ISO 42001, 18 September 2026. Source: The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file), https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json (checked 5 October 2026) ## What to do 1. Ask the customer or the tender exactly what it wants: ISO/IEC 42001 certification, and whether the certificate must be UKAS accredited. 2. Decide which AI roles your organisation plays, such as developer or user, and check that the body's UKAS schedule covers them. 3. Decide who helps you prepare, if anyone. It cannot be the body that will certify you. 4. Run the system for at least three months, with a management review and a full cycle of internal audits, before the first audit. 5. Ask accredited bodies for a quote that covers all three years, and compare them on the same basis. 6. Once you hold the certificate, check that it shows in [UKAS CertCheck](https://www.ukas.com/certcheck/). ## Common questions ### Is ISO 42001 a legal requirement in the UK? No. ISO/IEC 42001 is a standard, and no UK law requires it. A customer or a tender may ask for it, and then it is a condition of that contract. For the laws that do cover AI in the UK, see [how the UK regulates AI](/guides/uk-ai-regulation). ### We already have ISO 27001. Do we need ISO 42001 as well? Only if a customer, a tender or your own plans call for it. ISO 27001 is the standard for managing information security, and ISO 42001 is the standard for managing how you develop, provide or use AI, so one does not stand in for the other ([ISO, ISO/IEC 27001:2022](https://www.iso.org/standard/27001) and [ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026). See [ISO 42001 or ISO 27001: which do you need, and which first?](/guides/iso-42001-or-iso-27001). ### Does ISO 42001 certification show that our AI is safe? Not on its own. ISO 42001 is about how your organisation manages AI: its policies, objectives and processes. ISO says that, rather than looking at the details of specific AI applications, the standard gives a way to manage AI risks and opportunities across an organisation ([ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026). A certificate shows that an accredited body audited that management system. ### Does ISO 42001 meet the EU AI Act? The EU AI Act does not ask for ISO 42001 by name. Under Article 40 of the EU AI Act, a high-risk system that meets EU-approved standards counts as meeting the rules they cover, and Article 40 does not name ISO 42001 ([AI Act Service Desk](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-40), checked 5 October 2026). See [what the EU AI Act asks of a UK business](/guides/eu-ai-act-uk-business). ### Can my ISO 27001 certification body also certify ISO 42001? Only if its UKAS schedule lists ISO/IEC 42001. Accreditation is granted standard by standard, so a body accredited for ISO 27001 is not automatically accredited for ISO 42001. Read its schedule in the [UKAS directory](https://www.ukas.com/find-an-organisation/). See also [ISO 27001 certification and who can certify you](/guides/iso-27001-certification-and-who-can-certify-you). ### What about a certificate accredited outside the UK? Some certification bodies that work in the UK hold ISO/IEC 42001 accreditation from another country. DNV holds it through the Dutch accreditation body, RvA, Bureau Veritas through Italy's Accredia, and Intertek through JAS-ANZ. Their UKAS schedules did not include ISO/IEC 42001 when we read them in July 2026, and the UKAS search on 5 October 2026 did not return them. If a customer asks for a UKAS accredited certificate, ask it whether it accepts others ([DNV](https://www.dnv.co.uk/news/2024/ba_dnv_acknowledged_as_accredited_certification_body_for_ai_management_systems/), [Bureau Veritas](https://www.bureauveritas.it/newsroom/bureau-veritas-intelligenza-artificiale-vincente-ma-solo-con-affidabilita-governance-e) and [Intertek](https://www.intertek.com/news/2025/intertek-achieves-global-jas-anz-accreditation-for-isoiec-420012023-artificial-intelligence-management-system/), checked 17 July 2026). ## Where next - [Seeking ISO 42001 certification](https://theassurancedesk.com/best/certification-seeking.md) - [Exposed to the EU AI Act](https://theassurancedesk.com/best/eu-ai-act-exposed.md) - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md) - [How does the UK regulate AI?](https://theassurancedesk.com/guides/uk-ai-regulation.md) - [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md) - [Is there a qualification or certification for AI governance?](https://theassurancedesk.com/guides/ai-governance-qualifications-and-certification.md) ## Sources - ISO, ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system: https://www.iso.org/standard/42001 (checked 5 October 2026) - ISO, ISO/IEC 42006:2025, Requirements for bodies providing audit and certification of artificial intelligence management systems: https://www.iso.org/standard/42006 (checked 5 October 2026) - UKAS directory of accredited organisations, certification bodies, search for ISO/IEC 42001: https://www.ukas.com/find-an-organisation/?q=ISO%2FIEC+42001&type%5B%5D=279 (checked 5 October 2026) - UKAS, first accreditation for ISO/IEC 42001: https://www.ukas.com/resources/latest-news/ukas-grants-first-aims-accreditation/ (checked 5 October 2026) - UKAS, ISO/IEC 42001 artificial intelligence management systems: https://www.ukas.com/accreditation/about/developing-new-programmes/development-programmes/aims/ (checked 5 October 2026) - UKAS CertCheck: https://www.ukas.com/certcheck/ (checked 5 October 2026) - UKAS, schedule of accreditation 21923, PECB Group (certification of persons): https://www.ukas.com/download-schedule/21923/Personnel (checked 5 October 2026) - European Accreditation, FAQ 41.1: impartiality, ISO/IEC 17021-1:2015 clause 5.2.5: https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/ (checked 5 October 2026) - European Accreditation, FAQ 37.12: ISO/IEC 17021-1:2015 clause 9.1.3: https://european-accreditation.org/sp_accordion_faqs/question-37-12-iso-17021-12015-clause-9-1-3/ (checked 5 October 2026) - NQA, ISO 42001 certification: https://www.nqa.com/en-gb/certification/standards/iso-42001 (checked 5 October 2026) - ISOQAR, AIMS ISO/IEC 42001:2023 internal auditor course: https://isoqar.com/parent-courses/aims-iso-iec-42001-2023-internal-auditor-course/ (checked 5 October 2026) - AI Act Service Desk, Article 40 of the EU AI Act: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-40 (checked 5 October 2026) - BSI, ISO/IEC 42001 AI management system: https://www.bsigroup.com/en-GB/products-and-services/standards/iso-42001-ai-management-system/ (checked 5 October 2026) - ISOQAR, get a quote: https://isoqar.com/get-a-quote/ (checked 5 October 2026) - LRQA, ISO/IEC 42001 AI management system certification: https://www.lrqa.com/en-gb/iso-42001-ai-management-system-certification/ (checked 5 October 2026) - TÜV UK, management systems certification: https://www.tuv-nord.com/uk/en/services/management-systems-certification/ (checked 5 October 2026) - DNV, accredited as a certification body for AI management systems: https://www.dnv.co.uk/news/2024/ba_dnv_acknowledged_as_accredited_certification_body_for_ai_management_systems/ (checked 17 July 2026) - Bureau Veritas Italia, newsroom, on AI and its ISO/IEC 42001 accreditation (in Italian): https://www.bureauveritas.it/newsroom/bureau-veritas-intelligenza-artificiale-vincente-ma-solo-con-affidabilita-governance-e (checked 17 July 2026) - Intertek, JAS-ANZ accreditation for ISO/IEC 42001:2023: https://www.intertek.com/news/2025/intertek-achieves-global-jas-anz-accreditation-for-isoiec-420012023-artificial-intelligence-management-system/ (checked 17 July 2026) - ISO, ISO/IEC 27001:2022, Information security management systems: https://www.iso.org/standard/27001 (checked 5 October 2026) - The Assurance Desk: AI answers on AI governance in the UK, measured 18 September 2026 (data file): https://theassurancedesk.com/data/ai-answers-uk-ai-governance-2026-09-18.json (checked 5 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.