ISO 42001:2023
ISO 42001 certification online: AI Management System by self-assessment
With the ISO 42001 certificate from Zertify you show your management system to customers and purchasing teams. ISO 42001 certification works by self-assessment, with no on-site audit. It costs CHF 849 in the first year, then CHF 569 per year with an online re-audit.
- Questions
- 40
- Mandatory requirements
- all 13
- Other questions
- min. 18 of 27
- Validity
- 3 years
- First-year price
- CHF 849
01: Overview
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for AI management systems (AIMS). It sets out how organisations develop, provide or use AI systems responsibly: with clear roles, an AI policy, systematic risk assessment, impact assessments for the people affected and controls across the whole life cycle, from training data to operation.
02: Benefits
What it gives you
- Demonstrable AI governance for customers and partners
- Faster answers to supplier questionnaires on AI
- Structured groundwork for EU AI Act requirements
- Early detection of risks such as bias or wrong decisions
- Clear accountability for development, operation and oversight
- Human oversight before an AI output becomes a decision
03: Who it is for
Who is ISO 42001 for?
- Software vendors with AI features
- Developers of AI models and AI platforms
- Companies using AI in core processes
- Financial services, insurance and healthcare
- HR and staffing providers using AI tools
- IT service providers and system integrators
04: Requirements
Key requirements
Determine your role as AI provider, producer or user
Set an AI policy and assign responsibilities
Assess and treat AI risks
Carry out AI system impact assessments
Prepare a Statement of Applicability for the Annex A controls
Control data, development and operation of AI systems
05: Demand
Who asks for ISO 42001?
ISO/IEC 42001 is asked for where customers, partners or supervisors want to know how an organisation keeps its AI under control.
- Corporate customers in procurement
- Larger companies increasingly vet AI vendors with questionnaires on data sources, risks and oversight. A documented AI management system answers many of these questions in one go.
- Software and SaaS with AI features
- Anyone offering features such as text generation, recommendations or automated analysis has to explain how models are tested, monitored and improved.
- Regulated sectors and the EU AI Act
- Regulation (EU) 2024/1689 requires risk management, data quality, documentation and human oversight depending on the risk class. ISO 42001 is not mandatory for this and does not prove conformity, but it helps build that governance in a structured way.
06: Cost
What does ISO 42001 cost? Audit, consulting or self-assessment
With ISO 42001, the number and criticality of AI systems and your role as provider or user set the price. For an organisation with 10 to 50 employees, these orders of magnitude apply.
| Route | Indicative range | What is behind it |
|---|---|---|
| Accredited audit | CHF 8,000 to 18,000 initial audit, then 4,000 to 8,000 per year | The price follows the number of AI systems in scope and whether you develop models yourself. As the standard is new, the number of auditors is still limited. |
| Consulting and implementation | CHF 15,000 to 40,000 one-off | AI inventory, risk assessment, impact assessments, Statement of Applicability and life cycle processes. The impact assessments are often the biggest item. |
| Zertify self-assessment | CHF 849 in year 1, then CHF 569 per year | You check whether roles, AI policy, risk assessment, impact assessments, data controls and human oversight are demonstrably in place. It does not replace a legal review under the EU AI Act. |
All amounts are non-binding indicative ranges for Swiss SMEs, not quotes. The offers of the individual providers are what counts.
07: Duration
How long does ISO 42001 take?
For ISO 42001 all AI systems have to be inventoried and assessed first, so the accredited route usually takes six to twelve months.
| Phase | Accredited | Zertify |
|---|---|---|
| Inventory and assessment | 3 to 6 months for AI inventory, risk assessment, impact assessments and Statement of Applicability | None. You answer the questions based on where you stand today |
| Assessment | Stage 1 and 2, with samples from development, data and operation of the AI systems | About 30 to 40 minutes online, scored immediately |
| Certificate | Release after 2 to 6 weeks, then annual surveillance audits | PDF with QR verification within 4 hours |
08: Sample questions
Sample questions from the ISO 42001 assessment
Four of 40 questions from the catalogue, and why they count.
Is an AI risk assessment carried out against defined criteria that considers consequences for the organization, for individuals and for society?
The AI risk assessment is the core of the standard. It covers harm to the company and equally the consequences for individuals and society.
Is there a defined AI system impact assessment process that evaluates potential consequences for individuals, groups and society?
The impact assessment asks who an AI system affects and how. This is what sets ISO 42001 apart from other management system standards.
Are data quality requirements defined, and is it checked whether training, test and production data meet them, including with regard to bias?
A model is only as good as its data. Incomplete or biased training data leads to errors that are hard to fix later.
For AI systems with relevant impacts, is human oversight defined that can review outputs, override them or stop the system?
Human oversight stops an AI output from turning into a decision unchecked. It has to be defined before something goes wrong.
09: Assessment
How the assessment works
The assessment has 40 yes/no questions, online and at your own pace. 13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 27 questions you need at least 18 yes.
| The questions fall into these topics: | Questions | Mandatory |
|---|---|---|
| Context of the organization | 3 questions | 1 |
| Leadership and AI policy | 4 questions | 1 |
| Planning, risks and impact assessment | 5 questions | 5 |
| Resources and support | 4 questions | 2 |
| Operation | 3 questions | 1 |
| AI system life cycle | 5 questions | 0 |
| Data for AI systems | 4 questions | 0 |
| Information for interested parties | 3 questions | 0 |
| Use and third parties | 4 questions | 0 |
| Evaluation and improvement | 5 questions | 3 |
10: Price
Price and validity
First-year price
CHF 849
- From year 2
- CHF 569 per year
- Validity
- 3 years
Your customer requires an audit or an accredited certification? Clarify requirements
Included in the price
- Online assessment with 40 questions
- Certificate as PDF, issued under licence from SICE
- QR code on the PDF and a public verification page
- 3 years of validity
- Yearly online re-audit
- Support by email
The verification page shows the status, standard and validity of every certificate. Read more in the FAQ
See the sample and assessment methodChecklist
ISO 42001:2023 checklist by email
All 40 questions of the ISO 42001 self-assessment as a PDF to tick off, ordered by topic. Free, by email.
11: More standards
More standards
Many companies combine several standards. Two or more earn a discount.
- ISO 27001:2022: View standard
Information Security Management
AI systems often process sensitive data, and an existing ISMS provides risk methodology, access control and document control for the AIMS.
from CHF 849
- ISO 27701:2019: View standard
Privacy Information Management
If you use personal data to train or run AI, ISO 27701 demonstrates the data protection that the AI impact assessment relies on.
from CHF 799
- ISO 9001:2015: View standard
Quality Management
Requirements, verification, release and supplier control follow the same principles as in quality management, so a QM system saves set-up work.
from CHF 599
13: Questions
Frequently asked questions about ISO 42001
ISO 42001 certificate within 4 hours.
The assessment is free. You pay only once you have passed.
The verification page shows the status, standard and validity of every certificate.