AIRA › ISO/IEC 42001 Readiness
ISO/IEC 42001 · AI management system
ISO/IEC 42001 readiness assessment: get ready for AI management system certification.
ISO/IEC 42001 is the international, certifiable standard for governing AI, and enterprise buyers now ask about it in security reviews. We score you against every requirement, help you close the gaps, and test you before the certification body does.
What is ISO/IEC 42001?
ISO/IEC 42001 sets the requirements for an AI management system (AIMS): the policies, roles, risk and impact assessments, supplier controls and records an organization uses to govern the AI it builds, buys or uses. Its management system clauses (4–10) follow the same structure as ISO 27001, and Annex A lists 38 AI-specific controls.
It's voluntary, but it's increasingly a procurement checkbox. Certification body accreditation under ISO/IEC 42006 is rolling out.
What the readiness assessment gives you
- A maturity score for every management system requirement and Annex A control
- A draft Statement of Applicability with a justification for each control
- An AI system inventory and starter AI risk register
- Findings that name the evidence an auditor will ask for
- A crosswalk showing where the same work meets NIST AI RMF and EU AI Act obligations
Fixed-price ISO/IEC 42001 services
| Step | What you get | Price |
|---|---|---|
| Readiness | Clauses 4–10 and all 38 Annex A controls scored, a draft Statement of Applicability and a roadmap to Stage 1. 4–6 weeks. | $22,500 fixed |
| Policy pack | AI policy, risk and impact assessment procedures and templates, and an acceptable use standard, written to the standard. | $8,500 |
| Internal audit | A full AIMS internal audit and management review support, so Stage 1 and Stage 2 hold no surprises. | $18,500 per audit |
| Assurance | Quarterly reviews, regulatory change alerts and help preparing for annual surveillance audits. | From $3,500 / month |
Prices in U.S. dollars as of November 2026. We never internally audit work we designed.
A typical path to ISO/IEC 42001 certification
- Weeks 1–6Readiness
Gap assessment, draft Statement of Applicability and roadmap.
- Months 2–4Build
Policy, roles, risk and impact assessments, supplier controls.
- Months 4–6Operate
Run the controls and keep records auditors can sample.
- Month 6Internal audit
Independent internal audit and management review.
- Months 6–9Certify
Stage 1 and Stage 2 audits by an accredited certification body you choose.
Timelines vary with size and starting maturity.
Questions buyers ask
Will we be ISO/IEC 42001 certified at the end?
No. Only accredited certification bodies issue ISO/IEC 42001 certificates. We prepare you for certification with a readiness assessment and internal audit, so the certification audit goes smoothly.
We're an AI or SaaS vendor and a customer asked about ISO 42001. Where do we start?
The AI Vendor Trust Pack ($14,500, 3–4 weeks) gives you a governance review of one AI product, questionnaire answers, a customer-ready governance summary and an ISO 42001 gap list. Many vendors then move on to full readiness.
How does ISO 42001 relate to the NIST AI RMF?
NIST AI RMF is a voluntary framework for managing AI risk; ISO/IEC 42001 is a certifiable management system standard. Our assessments use the NIST method and map every finding to ISO 42001, so the same work counts toward both.
Find out how far you are from Stage 1
We'll reply within one business day to set up a 30-minute call.
AIRA prepares organizations for certification; certificates are issued only by accredited certification bodies. Not legal advice.