How much does ISO 42001 certification cost?

It’s the first question almost everyone asks, and the honest answer is that anyone quoting you a figure before they know your scope is guessing. That’s not evasion. It’s the single most useful thing to understand about how this is priced, because the same standard can cost wildly different amounts at two organisations of the same size.

Here’s what actually moves the number, and how to work out roughly where you’d sit before you speak to anybody.

Why the published ranges are close to useless

Search for a figure and you’ll find plenty. They’re mostly built from a handful of past projects at whatever kind of company the author works with, which tells you about that author’s client base and very little about you.

The cost splits into two parts that behave completely differently. There’s the certification body’s fee, which is reasonably predictable and based on audit days. And there’s everything you do before they arrive, which is where most of the money and nearly all of the variation lives. Quoting a combined range hides that split, and the split is the whole story.

What drives the certification body’s fee

Audit days. That’s essentially it, and the number of days is driven by how big and how complicated the thing being audited is.

The scope you declare matters more than your headcount. An organisation that puts one AI system in a single business unit inside the scope is a smaller audit than one covering AI across every function, even if the second has fewer staff. Certification also runs in two stages, a documentation review and then the main audit, and it doesn’t stop there. You’re committing to surveillance audits in the following years and a recertification cycle after that, so treat it as an ongoing cost rather than a one-off purchase.

If you already hold ISO 27001, some of this gets cheaper. The two standards share a structure and are designed to be integrated, so you already have the machinery ISO 42001 expects: internal audit, management review, corrective action. You’re layering AI-specific requirements onto a system that exists instead of building one from nothing.

The part that costs more than the audit

Getting ready. This is where organisations underestimate, because it doesn’t arrive as an invoice.

Someone has to write the policy and get it approved. Someone has to list the AI systems in use and work out, for each one, whether you’re the provider or the deployer. Risks have to be assessed, written down and owned. Suppliers have to be asked questions they may not enjoy. Staff need enough AI literacy that you can show how they got it. None of that is billable to an external party unless you choose to buy help, but all of it is time from people who already have jobs.

The organisations that find certification expensive are usually the ones that discovered these gaps late, in a room with an auditor, rather than early enough to fix them at their own pace.

The cheapest thing you can do first

Work out your scope before you ask for quotes, because scope is the variable the whole price hangs on. If you can tell a certification body which systems are in, which functions are covered, who owns the management system, and what you already have documented, you’ll get a quote that means something. If you can’t, you’ll get a range as vague as the one you gave them.

That’s also the point at which you find out whether you’re two months away or a year away, which tends to change the conversation about money entirely.

Where to start

The readiness worksheet walks the ten themes an ISO 42001 audit looks at and returns a ledger showing where you stand on each one. It won’t price the job, and it’s not pretending to. What it will do is show you the size of the gap, which is the thing you actually need before the cost question can be answered sensibly.

If you’d rather read the requirements first, the ISO 42001 requirements guide covers how the clauses fit together, and the certification guide sets out what the process involves once you commit. There’s also an ISO 42001 checklist if you’d sooner work through the themes on paper.