ISO 42001 cost: what you pay and where it comes from

ISO 42001 is a management system standard. You do not buy a product. You build a system for governing AI and have it checked. That is why the cost does not arrive as one invoice but in four parts, before, during and after the audit.

Certification body

Fees for the audit itself. They depend on audit days, headcount, number of AI systems and sites.

Consulting

Optional external help to build the AI policy, risk assessment and Statement of Applicability.

Internal effort

Hours your own people spend on documentation, interviews and evidence. This is the item most quotes leave out.

Recurring costs

Yearly surveillance audits and recertification after the certificate cycle ends.

• Guide: what ISO certification costs

On the classic route, a certification body audits your management system on site in two stages. The first stage checks your documentation, the second checks that you work as described. The body prices the audit in days, and the number of days follows from your size and scope.

As an indicative range, the initial audit for a small company lies between CHF 6,000 and CHF 15,000. A larger scope, several sites or many AI systems push the figure up. Bodies publish few fixed prices, so you receive a quote per case.

Request quotes from at least two bodies. Day rates differ, and so does their experience with AI management systems. Check whether travel costs and report fees are included.

Many small companies hire a consultant for the first certification. Indicatively, this adds CHF 10,000 to CHF 30,000, depending on how much of the system already exists. Without a consultant the money stays in the company, but the work moves to your own staff, usually the owner or the head of IT.

The standard asks for specific work, and each piece takes time:

1. 01

   Define your role

   Decide whether you act as AI provider, producer or user. The role determines which controls apply.

2. 02

   Write the AI policy and assign responsibilities

   Top management signs the policy and names who is accountable for AI systems.

3. 03

   Assess and treat AI risks

   List your AI systems, rate the risks and decide on measures.

4. 04

   Carry out impact assessments

   Document how each AI system affects the people it concerns.

5. 05

   Prepare the Statement of Applicability

   State which Annex A controls apply and why, covering data, development and operation.

The first audit is not the last invoice. On the classic route, the certification body returns every year for a surveillance audit, and the certificate cycle ends with a recertification audit. Indicatively, a surveillance audit costs CHF 3,000 to CHF 7,000 per year, and recertification CHF 5,000 to CHF 12,000.

Add the maintenance work in between. A new AI feature needs a risk assessment and an impact assessment. A changed supplier changes your controls. Management reviews and internal checks also take hours each year, and these hours belong in your budget.

Zertify costs CHF 849 (EUR 849) in the first year, then CHF 569 (EUR 569) per year, including the yearly online re-audit. The certificate is valid for 3 years. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. If you certify several standards, you get 20% off for two and 30% off for three or more, also on the yearly fee.

There is no consultant and no audit day. You answer 40 yes/no questions on ISO 42001. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 27, at least 18 must be yes. G6 Agency AG issues the certificate under licence from SICE, and SICE reviews every assessment first. After you pass and pay, the certificate arrives within 4 hours.

Every certificate has a number and a QR code on the PDF. Your customer or purchasing department checks it on the public verification page. The yearly fee renews automatically. You can cancel at any time in your customer account, and the certificate then ends with the paid year.

• Start the free self-assessment
• ISO 42001 at Zertify
• See all prices

The table sets the classic route against Zertify. The classic figures are indicative ranges for a small company and vary by scope and certification body.

• Compare the certification routes
• Certification without an on-site audit