ISO/IEC 42001 Cost
Mostly, it depends on what you already have in place. Here is how the costs break down, what we charge to get you ready, and what the audit will cost on top of that.
"Keep it Simple. Keep it Real."
Getting Ready
Most of what ISO 42001 costs is the work of getting ready: listing the AI you use, writing the policy, assessing the risks and impacts of each AI system, putting the controls in place, and running the system long enough to have records an auditor can check. That is the part we do, and we quote it as one flat fee for the whole project, so you know the full number before you commit.
Where your price falls depends mostly on where you start. These are the ranges our ISO projects have actually come in at, adjusted for what ISO 42001 adds.
| Where you are starting from | Gap assessment | Whole project, one flat fee |
|---|---|---|
| Small or mid-sized company, already certified to ISO 27001 or ISO 9001 | $3,500 to $7,500 | $10,000 to $25,000 |
| Small or mid-sized company, starting from nothing | Included in the flat fee | $15,000 to $40,000 |
| Larger company, or several sites | $7,500 to $10,000 or more | $35,000 and up |
The flat fee covers the whole path to the audit: scoping and the gap assessment, the AI system inventory, the policy, the risk and impact assessments, the Statement of Applicability, procedures, training, an internal audit, and a readiness check before the certification body arrives. Travel for on-site days is billed at cost.
If you are already certified, it usually makes sense to start with a gap assessment on its own, because it shows how much of your existing system carries over, and that can shrink the rest of the project a good deal. If you are starting from nothing, there is not much for a gap assessment to find, so we skip straight to quoting the whole project.
If you are an FDA-regulated manufacturer and your first worry is whether the AI already inside your quality system would hold up in an inspection, the AI in the quality system review is a smaller place to start.
What Moves the Price
Every AI system in scope needs an owner, a risk assessment, an impact assessment, and records, so this is usually the biggest single driver. Many companies certify a narrow first scope, such as the AI that customers ask about, and bring the rest in later.
More people and more locations mean more interviews, more training, and more places where the system has to work, and the same thing pushes up the certification audit.
A working ISO 27001, ISO 9001, or ISO 13485 system already covers much of what ISO 42001 asks for, and even a few written AI policies give us something to build on. See what ISO 42001 adds to an ISO 9001 system and ISO 42001 for AI and software companies.
If someone on your team can own the project and draft some of the documents, the fee comes down. If you would rather we carry more of the work, it goes up. Either way, your people still have to run the system, because that is what the auditor checks.
Comparing approaches? Read DIY, consultant or fractional and how to choose an ISO 42001 consultant.
The Certification Audit
The certificate itself comes from an independent certification body, which you contract and pay directly. It audits you in two stages, a review of your documented system (Stage 1) and then an audit of the evidence that the system is actually running (Stage 2), and after that it comes back once a year for a shorter surveillance audit.
Certification bodies charge by the audit day, and the number of days is set by your headcount and how complex your AI is, under the audit-time rules in ISO/IEC 42006[4]. For small companies, published estimates typically put the initial Stage 1 and Stage 2 audit at about $5,000 to $25,000[1][2], over roughly three to five audit days[3], with each yearly surveillance audit at about 20 to 40 percent of the initial fee[1][2].
Prices vary a lot from one body to the next, so get two or three written quotes covering both stages, surveillance, recertification, and travel. We help you ask for them and choose. If you already hold another ISO certificate, ask your current body whether it can audit ISO 42001 during a visit it is already making.
Timeline
Usually four to twelve months from the start of the work to the certificate. Some of these steps overlap.
| Step | Typical time |
|---|---|
| Gap assessment and scoping | 2 to 4 weeks |
| AI inventory, policy, roles, and assessment method | 4 to 8 weeks |
| Risk and impact assessments, Statement of Applicability, and procedures | 6 to 12 weeks |
| Running the system and building up records | 8 to 16 weeks, overlapping the step above |
| Internal audit and management review | 2 to 4 weeks |
| Stage 1 and Stage 2 audits, and the certificate decision | About 1 to 3 months, depending on the certification body's schedule |
Companies that already hold ISO 27001 or ISO 9001 and keep the AI scope small are at the short end. Our realistic ISO 42001 timeline walks through it month by month.
It depends mostly on what you already have. Getting ready is the larger cost. For a small or mid-sized company starting from nothing, we quote the whole project as one flat fee, usually between $15,000 and $40,000. If you already hold ISO 27001 or ISO 9001, it is usually $10,000 to $25,000. The certification body's audit is paid separately; published estimates for small companies typically run about $5,000 to $25,000 for the initial audit.
Usually between $3,500 and $10,000, depending on the size of the company, how many sites and AI systems are in scope, and whether it is done on site or remotely. It makes the most sense when you already run a management system. If you are starting from nothing, the assessment is part of the flat fee for the whole project.
Certification bodies charge by the audit day, and the number of days depends on your headcount and how complex your AI is. For small companies, published estimates typically put the initial Stage 1 and Stage 2 audit at about $5,000 to $25,000, over roughly three to five audit days, with yearly surveillance audits at about 20 to 40 percent of that. Get two or three written quotes; we help you choose.
Usually, yes. Document control, internal audit, management review, and corrective action already exist, so the work narrows to the AI-specific parts: the AI system inventory, the risk and impact assessments, the Statement of Applicability, and the controls around how AI is built, bought, and used.
Usually four to twelve months from the start of the work to the certificate. Companies that already hold ISO 27001 or ISO 9001 and have a small AI scope are at the short end. The certification body's schedule can add time, so it pays to book audit dates early.
No. We get you ready for the audit, and we do not perform certification audits. The certificate comes from an independent certification body that you contract and pay directly.
Our own price ranges come from our ISO certification projects and are confirmed in writing for your scope before any work starts.
Book a free 30-minute call. Tell us what AI you use and what you already have in place, and we will tell you which range you are in and what the flat fee would cover.
Or email us at support@certify.consulting