ISO/IEC 42001:2023 AI management system
ISO 42001 without audit: certificate based on a self-assessment
You answer 40 yes/no questions online instead of hosting an auditor at your premises. SICE reviews the assessment, and once you have passed and paid, the certificate arrives within 4 hours. It carries a number and a QR code, so your customers can check it themselves.
01: Principle
How does ISO 42001 work without an on-site audit?
In the classic route an auditor visits your premises, reads your documents and interviews your staff. Zertify replaces that visit with a structured self-assessment. The questions follow ISO/IEC 42001:2023: your role as provider, producer or user of AI, the AI policy, risk assessment, impact assessments, the Statement of Applicability for the Annex A controls, and the control of data, development and operation.
The assessment is not a form to click through. Each question asks about something that must exist in your company: a policy, an assigned responsibility, a documented risk assessment. If it does not exist yet, the honest answer is no.
Answer the questions
Forty yes/no questions on your AI management system. Starting the assessment costs nothing.
Reach the pass threshold
All 13 mandatory requirements must be answered yes, plus at least 18 yes among the other 27 questions.
SICE reviews the assessment
SICE checks every assessment before a certificate is issued.
Receive the certificate
G6 Agency AG issues the certificate under licence from SICE, as a PDF with certificate number and QR code.
02: Content
What does the certificate confirm?
It confirms that your company operates an AI management system that meets the requirements of ISO/IEC 42001:2023, as described in your assessment and found in order by SICE. A short online re-audit each year confirms that this still holds. The certificate is valid for 3 years.
- A management system, not a product test
- The certificate refers to how you manage AI: roles, policy, risks, impact assessments and controls. It does not test the technical quality of a single model.
- Self-assessment instead of a site visit
- No auditor comes to your premises. The evidence is your own answers, reviewed by SICE.
- Public verification
- Anyone can look up the certificate on the verification page by its number, or by scanning the QR code on the PDF.
- Yearly confirmation
- The online re-audit is part of the yearly fee. It keeps the certificate current.
A purchasing department that reads your certificate should understand it as exactly this: a documented and reviewed statement about your management system. If a customer contract demands an on-site audit by a certification body, clarify that before you buy.
03: Threshold
What do you need to pass the self-assessment?
Two rules apply at the same time. The 13 mandatory questions are requirements of the standard itself, so they cannot be offset by good answers elsewhere. A company with a detailed risk process but no AI policy does not pass.
| Question group | Number of questions | Rule |
|---|---|---|
| Mandatory requirements of the standard | 13 | All answered yes |
| Further questions | 27 | At least 18 answered yes |
| Total | 40 | Both rules must be met |
A no on a mandatory question points to a gap in your management system. Close that gap first, then the certificate follows.
04: Fit
Which companies suit an ISO 42001 certificate without audit?
The route suits companies that need proof of responsible AI use for customers, and that do not want to block weeks of staff time for an audit visit.
- Software vendors and AI developers
- Customers add AI governance questions to supplier questionnaires and tenders. A certificate with a verification page answers them in one attachment.
- Companies using AI in core processes
- If AI supports decisions about customers, credit or claims, you need roles, risk assessment and impact assessments in place anyway. The certificate documents them.
- Financial services, insurance and healthcare
- Customers in these sectors ask suppliers detailed questions about AI. A reviewed, verifiable certificate shortens the exchange.
- HR and staffing providers, IT service providers
- Using AI tools for candidates or for client systems makes you answerable for them. The standard asks you to assess the impact on the people affected.
If a tender or contract names an on-site audit by a certification body as a condition, the classic route is the right one for that case.
05: Comparison
ISO 42001 without audit or classic route: time and cost
The figures for the classic route are indicative ranges. Your actual quote depends on company size, the number of AI systems in scope and whether you work with an external consultant.
| Criterion | Zertify, online self-assessment | Classic route with on-site audit |
|---|---|---|
| Method | 40-question self-assessment, reviewed by SICE | On-site audit by a certification body |
| Time to certificate | Within 4 hours after passing and payment | Indicative: 3 to 9 months from first contact |
| Cost | CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit | Indicative: CHF 8,000 to 25,000 over three years, depending on size and consultancy |
| Yearly follow-up | Short online re-audit | Surveillance audit by the certification body |
| Verification | Public, by certificate number and QR code | Depends on the certification body |
Whichever route you choose, the work on your AI policy, risk assessment and impact assessments is the same. The routes differ in how that work is checked and how long you wait for the result.
06: Zertify
How Zertify issues the ISO 42001 certificate
Zertify runs the self-assessment and the payment online. G6 Agency AG issues the certificate under licence from SICE. You do not need an account to buy.
Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. If you certify against two standards, you get 20% off, and 30% for three or more, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.
07: FAQ
Questions about ISO 42001 without audit
08: Guide
Related pages
Find out whether you pass ISO 42001
Answer 40 yes/no questions and see which requirements your AI management system already meets.
Free and without registration.