ISO 42001 · AIMS · the AI standard

ISO 42001 certification — document AI governance, risks and impact assessments so they stand up to scrutiny

We build your AI management system to ISO/IEC 42001 — with an AI inventory, the AI policy, risk assessment, impact assessments, lifecycle controls and preparation for the certification audit.

  • Full service 9,000 – 29,900 € depending on company size
  • 4–8 months to being ready for certification
  • Can be combined with ISO 27001
  • EU AI Act evidence prepared systematically
  • 30 minutes assessment
Book an ISO 42001 assessment Start the ISO 42001 check
notivia since 2003· +50 ISMS clients*· +20 Full-service projects*· ISO 27001, ISO 42001 & the EU AI Act in one platform· ★★★★★5.0

* Audit success relates to completed full-service certification projects since 2019.

Quick check

This page is for you if …

  • … you want to prepare for develop, use or supply AI systems.
  • … you need a systematic AI management system (AIMS) .
  • … you want to stand out with certified AI governance .
  • … you want to prepare for the EU AI Act and ISO 42001 together .
  • … you want to know what ISO 42001 certification costs and how long it takes.
Our services for ISO 42001

Four building blocks. One route to compliance.

An AI management system to ISO/IEC 42001 — ready for certification, AI-specific and built to last.

Maximum support

Full-service support

We build your AIMS in a structured way — from the AI inventory and the AI policy through impact assessments, controls and the internal audit to certification preparation.

This suits you if you want ISO 42001 with as little internal project load as possible.
  • AI policy & strategy
  • AI lifecycle controls
  • The AI impact assessment process
  • Certification preparation
from €9,000 one-off · M from 18,000 € · L from 29,900 € Start-up up to 5 staff · plus the certification audit · all prices exclude VAT
Request a quote
Ongoing

Ongoing AIMS support

We support your internal team with AI governance, reviews, impact assessments, the management review, training and the interface to the EU AI Act.

This suits you if you want your AI governance maintained and the supervisory reporting taken off your hands.
  • AIMS governance and reviews
  • Quarterly management review
  • The interface to the EU AI Act
  • Training for AI development teams
from €700 / month
Enquire about ongoing support
12-month minimum term · 3 months' notice
One-off / yearly

Internal ISO 42001 audit

We audit your AIMS against the ISO/IEC 42001 clauses, the AI controls, the impact assessment process and your evidence.

This suits you if you want your AI management maturity verified before the certification audit.
  • An audit against every clause
  • An impact check for each AI system
  • Evidence mapping
  • A management review template
from €3,400 one-off
Enquire about an audit
Self-service

Build it yourself

Build ISO 42001 yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

Additionally for ISO 42001

Standard-specific extras — bookable individually

AI impact assessment

A structured assessment of the impact of a new AI system.

from €2,490

Building the AI lifecycle controls

Defining the process: development → operation → decommissioning.

from €4,900

Combined audit with ISO 27001

One internal audit for both — saves around 40 % of the effort.

from €4,500
AIMS operating support: 12-month minimum term · 3 months' notice to the end of the month · all prices exclude VAT.
Free initial assessment

AI governance to ISO 42001 — clarity in 30 minutes

The new AI management system standard: what you have to put in place, when it makes sense and what it costs.

Lead consultant
Lead consultant
Your contact
  • A quick answer
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·A quick answer·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free ISO 42001 check · 3 min

    How mature is your AI management?

    10 questions on AI governance, lifecycle controls, data quality and oversight. Rate your maturity in 3 minutes.

    Start the check

    Or do it yourself

    The ISMS platform with its ISO 42001 module

    The multi-standard ISMS digitalises the AI lifecycle controls, the impact assessments and the management reviews — made for internal teams that want to document ISO 42001 in a structured way.

    Explore the platform
    Guide · PDF

    ISO 42001 guide for AI officers

    What the standard requires, which clauses and annexes apply, how certification works — explained plainly.

    Download the guide
    The standard in brief

    What has to be in place for ISO 27001?

    Eight building blocks — the mandatory set for ISO 42001 certification.

    1. Context of the organisation (clause 4)
    2. Leadership & the AI policy (clause 5)
    3. Planning & AI risk management (clause 6)
    4. AI lifecycle controls (Annex A)
    5. AI impact assessment (clause 6.1.4)
    6. Data quality & governance
    7. Human oversight & transparency
    8. Internal audit & management review

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    WHO IS IT FOR?

    Who needs ISO 42001?

    ISO 42001 is for any organisation that develops, supplies or uses AI systems — whatever its sector or size.

    AI developers

    Companies that build AI models and systems — from machine learning to generative AI. Evidence of responsible AI development.

    AI users

    Organisations that use AI systems in their business — from chatbots through recruiting tools to automated decisions.

    AI service providers

    Cloud providers, SaaS vendors and consultancies that supply AI services to clients — proof of trustworthiness to their customers.

    STRUCTURE OF THE STANDARD

    The clauses of ISO 42001

    ISO 42001 follows the Harmonized Structure (Annex SL) — familiar from ISO 27001, ISO 9001 and other management systems.

    4

    Context of the organisation

    Understanding interested parties, the scope and your landscape of AI systems.

    5

    Leadership

    The AI policy, responsibilities and the commitment of top management.

    6

    Planning

    AI risks and opportunities, AI-specific objectives and the action plan.

    7

    Support

    Resources, competence, awareness, communication and documentation.

    8

    Operation

    AI risk assessment, AI system impact assessment, operational planning and control.

    9

    Performance evaluation

    Monitoring, measurement, analysis, internal audit and management review.

    10

    Improvement

    Nonconformities, corrective action and continual improvement.

    A

    Annex A — controls

    39 AI-specific controls in 9 categories: from data governance to ethics.

    ANNEXES

    The annexes of ISO 42001

    Besides the normative Annex A, ISO 42001 offers three informative annexes to help with implementation.

    A

    Controls

    39 normative controls in 9 categories for handling AI responsibly.

    B

    Implementation guidance

    Detailed guidance on implementing the Annex A controls.

    C

    AI risks & opportunities

    A reference catalogue of potential AI risks and opportunities for the risk assessment.

    D

    Domains & sectors

    Sector-specific guidance for different areas where AI is used.

    ANNEX A HIGHLIGHTS

    The key AI controls

    The 9 categories of Annex A cover the whole AI lifecycle.

    AI policies

    Setting an AI policy, assigning responsibilities and tying it into the company strategy.

    Impact assessment

    Impact assessment for AI systems: judging the effects on individuals, groups and society.

    Data governance

    Ensuring the quality, provenance and suitability of training, validation and test data.

    AI system lifecycle

    Systematically steering development, testing, deployment, monitoring and decommissioning of AI systems.

    Transparency & explainability

    Making AI decisions traceable and informing the people affected appropriately.

    Fairness & bias

    Detecting, measuring and systematically reducing bias in AI systems.

    Human oversight

    Appropriate human control and ways to intervene in AI decisions.

    Third-party management

    Managing risk from suppliers, pre-trained models and third-party AI services.

    Data protection & security

    Protecting personal data and cyber security across the whole AI lifecycle.

    OVERLAP

    ISO 27001 as the a strong basis for ISO 42001

    ISO 27001 is a strong basis for ISO 42001 — but it does not replace the AI-specific requirements. Both standards share many management system elements: context, leadership, planning, support, internal audits, the management review and continual improvement. ISO 42001 adds AI-specific requirements for the AI inventory, the AI policy, impact assessments, data governance, lifecycle controls, transparency, human oversight and third parties. Up to ~70 % structural overlap in the management system requirements, depending on how mature your ISMS already is.

    ISO 42001ISO 27001
    Cl. 4 context of the organisation Cl. 4 context (identical)
    Cl. 5 leadership & the AI policy Cl. 5 leadership & the security policy
    Cl. 6 AI risk management Cl. 6 security risk management
    Cl. 7 resources & competence Cl. 7 support (identical)
    Cl. 9 audit & review Cl. 9 performance evaluation (identical)
    Cl. 10 improvement Cl. 10 improvement (identical)
    up to ~70 %
    structural overlap in the management system requirements — depending on how mature your ISMS already is
    OUR SOLUTION

    Implementing ISO 42001 with iso-easy

    1

    AI inventory & scope

    Recording and classifying every AI system and defining the scope of the AIMS.

    2

    Gap analysis

    Comparing your existing processes against the ISO 42001 clauses and controls and identifying the gaps.

    3

    Build the AIMS

    Implementing the AI policy, the risk assessment, the impact assessment, the controls and the documentation.

    4

    Certification

    The internal audit, the management review and support through to a successful certification audit.

    AI risk assessment Impact assessment Data governance Bias monitoring 39 AI controls EU AI Act mapping

    Or do it yourself

    The ISMS platform for ISO 42001 — and 10 further standards

    Digitalise the AI management system, the impact assessments and the governance documents in a multi-standard ISMS. With an AI copilot, templates and the audit guide — made for teams with internal resources that want to maintain the AIMS, the impact assessments and the evidence digitally.

    • Multi-standard ISMS
    • AI copilot & templates
    • Audit guide
    • Cancellable monthly

    from €249

    / month · Starter with 1 standard

    Explore the platform
    FAQ

    Frequently asked questions about ISO 42001

    What is ISO 42001?
    ISO/IEC 42001:2023 is the first international standard for AI management systems (AIMS). It sets out requirements for handling AI responsibly — from development through operation to decommissioning.
    How does ISO 42001 differ from the EU AI Act?
    The EU AI Act is a law with binding requirements and fines. ISO 42001 is a voluntary standard for an AI management system. The two complement each other: ISO 42001 provides the framework for meeting the AI Act requirements systematically, and certification can serve as evidence of AI Act compliance.
    Can I combine ISO 42001 with ISO 27001?
    Yes, and it is the ideal route. Both standards share the same base structure (Annex SL / Harmonized Structure). Around 70 % of the management system requirements are identical. You can build an integrated ISMS + AIMS and gain both certifications in one combined audit.
    How long does certification take?
    With our full service, typically 4–8 months. If an ISO 27001 ISMS is already in place, extending it to ISO 42001 can be done in 2–4 months, because the shared management system base already exists.
    Is ISO 42001 mandatory?
    No, ISO 42001 is voluntary. But clients, partners and supervisory authorities increasingly expect it as evidence of responsible AI. In the context of the EU AI Act, certification can serve as evidence of conformity.
    What are the 39 controls in Annex A?
    Annex A contains 39 AI-specific controls in 9 categories: AI policies, internal organisation, resources, impact assessment, the AI system lifecycle, data, information for stakeholders, use of AI systems and third-party relationships. Conceptually they resemble the 93 controls in ISO 27001 Annex A.
    How much internal work does this really mean for us?
    Setting ISO 42001 up from scratch the conventional way swallows 40–60 person-days of internal time (the AI inventory, the risk assessments, documenting the lifecycle controls). With our approach plus the ISMS platform we bring that down to 15–25 person-days — because we set up most of the AI policies, the impact assessment templates and the lifecycle documentation for you.
    What is the difference between ISO 27001 and ISO 42001?
    ISO 27001: an information security management system (ISMS) — it protects all information from unauthorised access. ISO 42001: an AI management system (AIMS) — it manages responsible AI development and use. Both share the same structure (Annex SL, 7 clauses) and can be combined. With ISO 27001 in place you build ISO 42001 on top with around 50 % overlap.
    Do we need ISO 42001 if we are implementing the EU AI Act?
    ISO 42001 does not replace the EU AI Act, but it can be a strong basis for evidencing AI governance, risk management, documentation, monitoring and responsibilities in a structured way. Which legal duties apply also depends on your role, the risk level and the context in which your AI systems are used.
    Can we certify ISO 27001 and ISO 42001 together?
    Yes, and it is the most efficient way. Both standards share the high-level structure (clauses 4–10). In a combined audit the auditor looks at both at once — saving around 40 % of the audit time and cost. We offer a combined internal audit from €4,900 (see the extras).
    How long does ISO 42001 certification take?
    For SMEs with a clearly bounded AI scope: 4–6 months. For companies with a complex AI portfolio: 6–9 months. What you need: the AI inventory, an agreed AI policy, documented risk and impact assessments, and at least one internal audit. We are with you at every step through to the DQS or TÜV audit.