What drives the cost and timeline of ISO 42001 certification?

ISO/IEC 42001 certification cost and timeline are driven by four things: the scope of your AI management system, your role relative to the AI systems in scope, how many people and controls are covered, and how much of an existing ISO 27001 program you can reuse. Auditors set fees from those inputs, so there is no honest flat price.

What is being certified?

ISO/IEC 42001 is a management system standard for artificial intelligence. You certify the management system (policies, risk process, roles, records), not a model. An accredited certification body audits it. Safeguard does not certify anyone; this post explains how the process is structured so you can plan.

How does the audit run, and how long does each step take?

The Cloud Security Alliance describes the usual path. Pre-work comes first: decide whether you are an AI provider, producer or user, define the scope, write policies and objectives, and complete an AI risk assessment and an AI impact assessment. An optional readiness review can find gaps early.

Then come two audits. Stage 1 reviews documentation and design and typically takes one to two days. The gap before Stage 2 is typically four to twelve weeks and should not exceed six months. Stage 2 checks that controls actually operate and typically takes three to nine or more days. The certificate is valid for three years, with annual surveillance audits that need about a third of the initial audit time.

These are typical figures reported by one industry body, not rules in the standard. Your certification body will quote its own.

Which factors move the price and the calendar?

Role and scope. An organization that builds models faces a bigger scope than one that only uses a vendor's model. A narrow scope, such as one product line, is faster than the whole company.

People and controls. Audit duration grows with the number of in-scope personnel and the number of Annex A controls you claim apply.

Risk assessment breadth. The risk work has to look past information security to societal, legal, ethical and operational impact. Teams used to a security-only risk register often underestimate this.

Existing ISO 27001. You can reuse parts of an information security management system, such as document control, internal audit and management review. ISO 42001 still adds AI-specific requirements on top.

Stage 1 findings. Areas of concern raised at Stage 1 can become formal nonconformities at Stage 2 if you do not fix them. Fixing them costs calendar time.

Evidence quality. Gathering logs, inventories and approvals by hand late in the project is the quiet cost. Teams that keep an AI system inventory current from day one spend less time on it.

What to do

1. Write down your role for each AI system: provider, producer, user, or a mix.
2. Pick the smallest scope that still matches what customers ask about.
3. Build an inventory of AI systems, models, data sources and owners before the audit is booked.
4. Run the AI risk and impact assessments with legal and product in the room, not security alone.
5. If you hold ISO 27001, map which processes you can extend rather than rewrite.
6. Ask two or three certification bodies for quotes using the same scope statement, and compare what is included.
7. Book a readiness review only if you have no prior management system experience.
8. Plan the surveillance audits now so owners keep records current between audits.

Quick check

Sources

• What to Expect in the ISO 42001 Certification Process, Cloud Security Alliance
• ISO/IEC 42001, ISO (page could not be fetched on 18 October 2026; check the standard text for requirements)

Last reviewed: 18 October 2026.