ISO 42001 certification
Is ISO 42001 mandatory?
ISO 42001 is a voluntary standard. Nobody has to certify just because it exists. In practice, a supplier questionnaire, a tender or a purchasing policy can make the certificate a condition for the order, and then you need it within days, not months.
01: Short answer
Is ISO 42001 certification mandatory?
No. ISO/IEC 42001:2023 is an international standard for AI management systems. A standard is a recommendation. It becomes binding for you only when a contract, a tender or a regulation refers to it. This page does not describe any law that prescribes ISO 42001. If you need to know whether sector rules apply to your business, ask your legal adviser.
The pressure comes from the other side of the table. A customer who buys software with AI features, or who hands you data to be processed with AI tools, wants to know who is responsible and how risks are handled. A certificate answers that question in one document.
02: De facto required
When does ISO 42001 become a requirement in practice?
The requirement arrives as a line in a document you have to fill in or a criterion you have to meet. The table shows the usual places where it appears.
| Situation | What the other side asks | What you hand over |
|---|---|---|
| Supplier questionnaire | Do you run an AI management system, and is it certified? | Certificate number and link to the verification page |
| Tender | ISO 42001 as a suitability or award criterion | Certificate as PDF with QR code |
| Customer audit | Evidence of AI policy, risk assessment and impact assessment | Certificate plus your own documents |
| Purchasing policy of a large customer | Certified AI governance from every supplier that uses AI on its data | Certificate uploaded to the supplier portal |
| Industry expectation | A recognised framework for AI in finance, insurance or healthcare | Certificate as reference to an international standard |
In every row the request comes from a contract partner, not from an authority. That is why it usually arrives with a deadline.
03: Who is asked
Which businesses are asked for ISO 42001 first?
The standard applies to organisations that develop, provide or use AI systems. These groups hear the question most often.
- Software vendors with AI features
- Customers ask how the model was trained, who reviews its output and how incidents are handled.
- Developers of AI models and platforms
- Buyers want to see roles, an AI policy and impact assessments before they integrate your model.
- Companies using AI in core processes
- Your own customers want to know that the AI behind your quotes, scoring or planning is under control.
- Financial services, insurance and healthcare
- Decisions about people carry weight here, so counterparties look for a recognised framework.
- HR and staffing providers
- Screening and ranking tools affect candidates directly, and clients ask how that impact is assessed.
- IT service providers and system integrators
- You build or operate AI for others, and their procurement teams pass their requirements on to you.
04: Customer request
What to do when a customer asks for ISO 42001
Do not start with the certificate. Start with the wording of the request, then work through these steps.
Read what is actually required
Some customers want a certificate, others only a description of your controls. Ask for the exact requirement and the deadline.
Determine your role
The standard distinguishes AI provider, producer and user. Your role decides which controls apply to you.
Check your documents
You need an AI policy, assigned responsibilities, a risk assessment, impact assessments and a Statement of Applicability for the Annex A controls.
Take the self-assessment
It shows within minutes which requirements you already meet and which are missing.
Send the certificate with its verification link
Your customer can check the number or scan the QR code without contacting you.
05: With Zertify
How to get ISO 42001 certified quickly with Zertify
The Zertify route is an online self-assessment with 40 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 27 you need at least 18 yes answers. SICE reviews every assessment, and the certificate is issued by G6 Agency AG under licence from SICE. After you have passed and paid, it arrives within 4 hours. Every certificate can be verified publicly by number and QR code.
The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. There is no on-site audit and you do not need an account to buy.
If you hold several standards, the multi-standard discount of 20% for two and 30% for three or more also applies to the yearly fee.
06: Before you order
Check that your customer accepts this kind of certificate
Zertify certifies on the basis of an online self-assessment, confirmed every year by a short online re-audit. Most requests only ask for a valid, verifiable ISO 42001 certificate. A few tender documents name an on-site audit by a certification body. Read the clause before you order, and ask the customer if it is unclear.
The certificate does not replace your own documents. A customer audit will still ask to see the AI policy and the risk assessment behind the answers you gave.
07: FAQ
Questions about ISO 42001 being mandatory
08: Guide
Related pages
A customer is asking for ISO 42001?
Take the self-assessment and see within minutes whether you meet the requirements.
Free and without registration.