Skip to content

AI governance · ISO / IEC

ISO/IEC 42001:2023 AI Management System

The management-system certification for AI, built the same way as ISO 27001, for companies whose product runs on AI.

Take the 3-minute Cyber Hygiene Test

Rather skip the call? Get a fixed-fee ISO 42001 quote in writing.

One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing

Who it applies to

The businesses that carry ISO 42001, and the pages written for them.

Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.

AI & Technology Companies

Which packages prepare you for it

Cyber and Data Protection Assessment

Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year

Fixed feescoped in 30 minutes
Details →

There is no ISO 42001 package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the ISO 42001-specific requirements are scoped with you in a 30-minute call.

What it asks for

In plain English, what ISO 42001 expects you to have in place.

  • An AI management systemScope, policy, roles and objectives for how the organization develops or uses AI.
  • AI impact and risk assessmentWho is affected by each system, what could go wrong, and how it is controlled.
  • Annex A controlsData quality, system lifecycle, transparency, human oversight, supplier management and incident handling.
  • Records and monitoringDocumentation of each system and its performance, reviewed on a schedule.
  • Alignment with ISO 27001The same management-system structure, so one program can carry both.
  • An accredited certification bodyCertification comes from an accredited body. We prepare you and keep the evidence current.

A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.

Or start with the 3-minute test

Where it starts

Your one-stop shop for ISO 42001

ISO 42001 is ISO 27001's shape applied to AI: a management system, a risk and impact assessment for each AI system, a Statement of Applicability, and controls on data, transparency and human oversight.

We build it on the ISO 27001 or SOC 2 work you already have, so the second certificate costs a fraction of the first.

Draw the boundary: tick what uses AI

Tick what applies and we draft the scope of the AI management system.

The steps

Six steps from "does ISO 42001 apply to us?" to evidence you can show

The whole ISO 42001 journey, short version. We handle every step with you.

draw the boundary

Write the scope statement

What the certificate covers: which products, sites, teams and systems. Small and precise beats large and vague; the scope statement is printed on the certificate.

With AccuSights: we draft it with you from the intake form and check it against what your buyers actually asked for.

name the risks

Run the risk assessment

The standard wants a documented method, a register of risks, owners and a treatment plan. This is the heart of the management system and the first thing Stage 1 reads.

With AccuSights: your engineer runs it with you and writes it in the form certification bodies expect.

assess the impact

Run the AI impact assessment

For each AI system: purpose, data, affected people, harms, oversight. The control the standard is best known for.

With AccuSights: our AI governance check and the risk assessment produce it in the form auditors expect.

close the gaps

Implement and document

Policies, access control, supplier agreements, logging, backup, incident handling and the records that prove each one ran. Most small companies underestimate the records.

With AccuSights: remediation is in-house, and the evidence collects itself in one place.

run the system

Operate the ISMS

Internal audit, management review, objectives measured, corrective actions logged. Stage 2 wants to see the system running, not just written.

Control monitorIllustration
  • Model inventory currentPassing
  • Impact assessments signedPassing
  • Access reviewed this quarterPassing
  • Supplier terms on filePassing

With AccuSights: we run the internal audit and chair the first management review with you.

two stamps

Stage 1 and Stage 2 audits

Stage 1 is a document review: are you ready? Stage 2 is the audit proper: does the system work? Pick an accredited certification body; the accreditation mark is what buyers check.

a check every year

Surveillance audits

Years one and two after certification bring a shorter surveillance audit each; year three is recertification. Nonconformities have to be closed on time.

With AccuSights: the evidence is already filed, so surveillance is a half day, not a month.

Why AccuSights

Why small teams pick AccuSights for ISO 42001

Most compliance platforms assume you have a security team. We built this for the companies that do not.

Priced for a startup, not a Series D

One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.

The endpoint agent is built in

Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.

A human who has done this before

A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.

Written once, read everywhere

One control set is mapped to every framework you carry, so evidence is produced once and reused.

ISO 42001ISO 27001SOC 2NIST AI RMFEU AI Act

What it costs

What ISO 42001 costs, in plain numbers

Here is what is published, with who published it and when.

$15,000 and upWhat one compliance vendor publishes for an ISO certification audit, with about $10,000 a year for surveillance; ISO 42001 follows the same two-stage shape.Source: Secureframe, How Much Does ISO 27001 Certification Cost?, fetched 6 October 2026
A fixed feeReadiness, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)

Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.

Get my ISO 42001 quote

Self-serve compliance software

  • You get a portal and drive it yourself.
  • Expert help is often a separate purchase or a partner referral.
  • Device checks usually need an MDM you set up first.
  • Pricing comes after a sales call.

AccuSights

  • A named engineer runs it with you.
  • Guidance and remediation are included, not referred out.
  • The endpoint agent ships with the platform.
  • A fixed fee, in writing, within 24 hours of the intake form.

Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing

Questions

ISO 42001 questions we get every week

Who needs ISO/IEC 42001?
No law requires it. Companies whose product or service runs on AI pursue it when enterprise customers ask how their AI is governed, much as they ask for SOC 2 about security. It also suits firms that use AI heavily on client data and want an independent, recognized structure for it.Source: ISO, ISO/IEC 42001:2023
How does ISO 42001 fit with ISO 27001?
Both use the same high-level management system clauses, so leadership, risk assessment, internal audit and management review can run as one system. ISO 42001 adds AI-specific controls in its annexes, such as impact assessment, data for AI systems and life cycle controls. One integrated system is cheaper than two.Source: ISO, ISO/IEC 42001:2023
Does ISO 42001 make us compliant with the EU AI Act?
Not by itself. It gives you the governance, risk and documentation habits the AI Act expects, which makes conformity work easier, but the Act has its own obligations by risk class and role, phased in over several years. Treat 42001 as the foundation, then map the specific duties that apply to you.Source: European Commission, AI Act
How does the NIST AI RMF relate to ISO 42001?
The NIST AI Risk Management Framework is voluntary guidance on what good AI risk management looks like, in four functions. ISO 42001 is a certifiable management system that puts that kind of practice into auditable form. Many teams use the NIST framework to decide what to do and 42001 to prove it.Source: NIST AI Risk Management Framework
Do you certify ISO 42001?
No. An accredited certification body audits and certifies. We prepare you: the AI inventory, policy, roles, the impact assessments, the controls and an internal audit, built on the evidence you already keep for ISO 27001 or SOC 2 so nothing is done twice.
Where do we start with ISO 42001?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do ISO 42001 separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.

Also in AI governance: NIST AI RMF · every framework by industry

Next step

Thirty minutes, an engineer, a written scope for ISO 42001.

Book the demo and see how one control set carries ISO 42001 and everything else you owe. Or leave your details and an engineer replies within one business day.

Get a fixed-fee quote

See how we use your information

3-min test