ISO 42001 consulting: what you pay for and what you can do yourself

ISO/IEC 42001:2023 asks for an AI management system: an AI policy, defined roles, systematic risk assessment, impact assessments for the people affected and controls across the life cycle of each AI system. A consultant turns these requirements into documents and routines that fit your company.

The work usually falls into six tasks.

Gap analysis

Compares how you use AI today with the requirements of the standard and lists what is missing.

Role and scope

Clarifies whether you act as AI provider, producer or user, and which AI systems belong to the management system.

Policy and responsibilities

Drafts the AI policy and assigns an owner to each task, from data quality to incident handling.

Risk and impact assessments

Sets up the method and runs the first assessments with your team, system by system.

Statement of Applicability

Selects the Annex A controls that apply to you and justifies those you leave out.

Audit preparation

Reviews the evidence, trains staff and prepares management for the questions an auditor or customer will ask.

• ISO 42001 requirements in detail

The figures below are indicative ranges, not quotes. Offers differ by consultant, company size and the number of AI systems in scope. A typical day rate is CHF 1,200 to 2,000.

The more AI you develop yourself, the longer the project. A company that only uses third-party tools has far fewer systems to assess than a vendor that trains its own models.

• Certification cost explained
• Compare the certification routes

For the certificate itself, no. The Zertify certificate rests on your own answers to the self-assessment, and nobody has to write the documents for you. A consultant saves time if you cannot spare it, or if your AI systems are complex enough that the risk assessment needs an experienced second pair of eyes.

You can usually manage alone if the following applies.

1. 01

   One person owns the topic

   Someone in management knows which AI systems are in use and can decide on policy and responsibilities.

2. 02

   You mainly use third-party AI

   Your AI comes from suppliers, so the controls concern selection, configuration and operation rather than model development.

3. 03

   The request is for a certificate

   A supplier questionnaire, a tender or a purchasing department asks for proof of an AI management system, not for a custom programme.

• ISO certification for small and medium businesses

The self-assessment has 40 yes/no questions on ISO 42001. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 27 questions, at least 18 need a yes. A yes means the requirement is in place in your company, so the questions work as a checklist for your own preparation.

Once you have passed and paid, the certificate arrives within 4 hours. SICE reviews every assessment before the certificate is issued by G6 Agency AG under licence from SICE. There is no on-site audit. The certificate is valid for 3 years and confirmed every year by a short online re-audit.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the online re-audit. You can cancel in your customer account at any time to the end of the current year; the certificate then ends with the paid year. You need no account to buy.

Customers and purchasing departments can check the result on the public verification page, using the certificate number or the QR code on the PDF.

• ISO 42001 certificate at Zertify
• Pricing and multi-standard discounts
• Start the free self-assessment

The assessment checks what exists in your company. It does not create it. Doing the following work first, with or without a consultant, makes the 13 mandatory questions straightforward.

1. 01

   List your AI systems

   Note which systems you develop, provide or use, and your role for each.

2. 02

   Write the AI policy

   Keep it short, have management approve it and name who is responsible for what.

3. 03

   Document the risk assessment

   Record the risks per system, how you rate them and what you do about them.

4. 04

   Carry out impact assessments

   Describe how each system can affect the people it is used on, such as applicants, customers or patients.

5. 05

   Prepare the Statement of Applicability

   Go through the Annex A controls, mark which apply and give a reason for each exclusion.

6. 06

   Check data, development and operation

   Make sure training data, changes to systems and day-to-day operation are controlled and traceable.

• How the process works
• Test your readiness