The ISO 42001 process, step by step

The process runs entirely in the browser. Most of the work happens before you open the first question: you need to know how your company builds or uses AI.

1. 01

   Collect the facts about your AI use

   Note which AI systems you develop, provide or use, who is responsible for them and which risks you have already assessed.

2. 02

   Answer the 40 questions

   Each question is a yes or no. The assessment is free and needs no registration.

3. 03

   Reach the pass mark

   All 13 mandatory requirements must be answered yes. Of the other 27 questions, at least 18 must be yes.

4. 04

   Pay for the certificate

   After passing you choose the certificate and pay. You do not need an account to buy.

5. 05

   SICE review and issue

   SICE reviews your assessment. G6 Agency AG then issues the certificate under licence from SICE, within 4 hours of passing and payment.

6. 06

   Share and verify

   You receive a PDF with the certificate number and a QR code. Both lead to the public verification page.

• How Zertify works

ISO/IEC 42001 asks how an organisation handles AI responsibly. The questions follow the requirements of the standard, so these are the topics you should be able to answer from your own documents.

Your role

Decide whether you act as AI provider, producer or user. The role shapes which obligations apply to you.

AI policy and responsibilities

A written policy and named people who answer for AI systems. A policy without an owner does not count for much.

Risk assessment and treatment

A systematic list of AI risks and what you do about each one.

Impact assessment

An assessment of what an AI system means for the people it affects, such as applicants, customers or patients.

Statement of Applicability

A document that lists the Annex A controls and states which ones you apply and why.

Control over the life cycle

Rules for training data, development and operation of your AI systems.

• ISO 42001 requirements in detail

The 40 questions fall into two groups. The first group is not negotiable: a single no on a mandatory requirement means you have not passed, however well you score elsewhere.

Once you have passed and paid, your assessment goes to SICE for review. The certificate is issued by G6 Agency AG under licence from SICE, and every assessment is reviewed before that happens.

The PDF carries a certificate number and a QR code. A purchasing department, a customer or a tender office scans the code or enters the number on the public verification page and sees that the certificate exists and is valid.

The certificate is valid for 3 years. Each year a short online re-audit confirms it. There is no site visit at any point.

• Certification without an on-site audit

Zertify covers the assessment, the review and the issue of the certificate. It does not replace the internal work on your AI policy or your risk register. That remains yours.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. The certificate runs as an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year.

If you certify against two standards, you get 20% off. With three or more it is 30%, also on the yearly fee.

• ISO 42001 certificate
• Pricing
• Start the free self-assessment

The classic route means a certification body sends auditors to your premises. It suits companies whose customers explicitly ask for it. The table shows where the two routes differ in practice.

• Compare the certification routes