ISO 42001 for financial services: certificate online

A bank that buys a scoring engine has to explain to its own audit committee how that model is governed. An insurer that lets a chatbot answer policyholders faces the same question. Purchasing departments now put it into the supplier questionnaire: do you run an AI management system, and can you show proof?

ISO 42001 gives both sides a common reference. It is a management system standard, comparable in structure to ISO 27001, but built around AI. It covers roles, an AI policy, risk assessment, the impact on affected people and controls from training data to operation.

A fintech that sells to banks answers the questionnaire line with one certificate. A bank or insurer uses the same certificate when its own corporate clients, partners or tender documents ask how AI is controlled.

• ISO 42001 standard page

The standard does not care whether you build a model yourself or buy it. It cares that the system has an owner, a documented purpose and controls. In financial services these are the usual candidates:

Credit scoring

A model estimates the likelihood of default and influences who gets a loan and at what rate. Applicants are directly affected, so the impact assessment carries weight.

Fraud detection and transaction monitoring

False alerts block legitimate payments, missed alerts let fraud through. Both error types need to be measured and reviewed during operation.

Client chatbot or voice assistant

The system answers questions about fees, balances or claims. It needs defined limits and a clear handover to a person.

Claims triage

An insurer's model sorts claims into automatic payout or manual review. Data quality and skewed training data are the main risks.

Onboarding and document checks

Software reads identity documents and extracts data for the customer file. Errors here create rework and wrongly rejected customers.

Portfolio suggestions

A tool proposes investments from a client profile. The design, the test results and the changes over time must be documented.

The requirements are the same for every sector. What changes is the evidence you point to.

1. 01

   Determine your role

   Write down for each AI system whether you provide it, produce it or use it. A bank running a vendor's scoring model is a user. The vendor is the provider.

2. 02

   Set an AI policy and assign responsibilities

   Management signs a short policy. The head of risk or the CIO is named as owner for each system, not a committee.

3. 03

   Assess and treat AI risks

   Keep a risk register per system: biased outcomes, model drift, data leaks, over-reliance on automated decisions. Each risk gets a measure and an owner.

4. 04

   Carry out impact assessments

   For a lending model, describe who is affected, what a wrong decision means for them and how a customer can have a result reviewed by a person.

5. 05

   Prepare a Statement of Applicability

   Go through the Annex A controls and record which apply to you and why. A firm without its own models can justify excluding development controls.

6. 06

   Control data, development and operation

   Define where training data comes from, who approves a model change, how performance is monitored and when a model is retired.

Your role decides how many controls apply to you. Many financial firms hold more than one role at once, depending on the system.

You start with an online self-assessment of 40 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 27 questions you need at least 18 yes answers. You can start without an account and without paying.

SICE reviews every assessment. The certificate is then issued by G6 Agency AG under licence from SICE, within 4 hours after you have passed and paid. There is no on-site audit. Every certificate carries a number and a QR code on the PDF that leads to a public verification page, which is what your customer's purchasing department will open.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. The subscription renews automatically and can be cancelled at any time in your customer account, effective at the end of the paid year. Firms that add a second or third standard receive 20% or 30% off, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

• Start the free self-assessment
• See pricing
• ISO 42001 at Zertify

Start with a list of every AI system in use, including tools that individual teams adopted without IT. Most firms find more systems than they expected. For each one, note the owner, the purpose and whether the firm is provider, producer or user.

Next, check that you have a signed AI policy, a risk register and at least one written impact assessment for the system that affects customers most. The self-assessment questions follow these documents closely, so gaps become visible before you pay anything.

The certificate shows that a management system for AI is in place and confirmed every year. It does not approve an individual model. If your client expects an on-site audit by a certification body, compare the routes first.

• Compare certification routes
• Certification without an on-site audit