How much does ISO 42001 certification cost?
Published prices are scarce. Of the eight certification bodies in our study, only Tempo Audits publishes ISO 42001 certification prices. Its figures indicate an initial certification cost of £3,500 to £20,000, with surveillance audits from £1,600 a year and recertification from £3,500. Your organisation's size, scope and AI systems will determine the quote.
What to know about ISO 42001 certification costs
- Initial certification costs about £3,500 to £20,000 or more. That fee covers both Stage 1 and Stage 2 of the initial certification audit.
- The certification cycle lasts three years. Annual surveillance audits in years two and three cost about £1,600 to £9,000 each. Recertification at the end of the cycle costs about £3,500 to £14,000.
- Around 70-75% of the quoted audit time is spent with auditors. The remaining time covers planning, reporting and certification administration.
- Your price depends on headcount, the number of AI systems in scope, your organisational role, the number of sites and the requirements of your sector. Regulated-sector work can add to the cost.
- The audit fee covers the audit and the certificate. Budget separately for consultancy, implementation support, training, remediation and system-management software.
What actually moves the price
Headcount sets the starting point for audit time. Certification bodies use audit-day tables for management-system standards, then adjust the baseline for the organisation's scope.
For ISO 42001, the number of AI systems in scope is a major factor. The functions those systems perform matter too. Five low-stakes recommendation models generally require less scrutiny than one model used for credit decisions.
Your role in the AI supply chain also affects the evidence an auditor needs. An organisation providing AI systems usually has more to demonstrate than one using AI internally.
Site numbers affect sampling. More sites usually mean more locations or processes need to be included in the audit. Work in a regulated sector can add further evidence requirements, particularly where AI is used in higher-risk ways.
A narrower scope can reduce the certification fee, provided it reflects how your organisation actually operates. Check customer requirements before excluding systems, teams or locations. Ask the certification body to confirm the proposed scope and audit-day total before accepting the quote.
Indicative ISO 42001 certification costs by stage
Tempo Audits is the only certification body in this study that publishes prices. These figures provide practical benchmarks for each stage of the certification cycle. They are not market averages, and your quote will depend on your organisation's scope and audit requirements.
| Stage | Indicative cost | What you get |
|---|---|---|
| Initial certification, Stage 1 and 2 | £3,500 to £20,000+ | Audit planning, Stage 1 and Stage 2 audits, reporting, technical review and certification |
| Surveillance audit, year two | £1,600 to £9,000 | An audit checking that the management system continues to operate |
| Surveillance audit, year three | £1,600 to £9,000 | A follow-up audit covering the system's ongoing operation, similar to the year-two surveillance audit |
| Recertification, year four | £3,500 to £14,000 | The full audit cycle repeated, usually at a lower cost than initial certification |
| Gap analysis, optional | Quoted separately | A review comparing your current arrangements with the requirements of the standard |
Questions to ask before you accept a quote
-
01
How many audit days, and at what rate?
Ask for both figures. A low daily rate can still produce a higher total if the certification body has allowed for more audit days. The number of days should be clear enough for you to compare the overall cost. -
02
How much time will you spend with an auditor?
Ask how much of the quoted time involves working directly with an auditor. About 75% is typically time with an auditor. If the proportion is lower, ask what the remaining time covers and whether surveillance costs for years two and three are included. -
03
Can ISO 42001 be integrated with ISO 27001?
If you already hold ISO 27001, or plan to certify against it, ask whether the audits can be integrated. Any saving should appear as fewer quoted audit days, with the amount explained clearly. A general statement about integrated audits does not show what you will save. -
04
Are follow-up visits included?
Ask whether the quoted price includes follow-up visits. A major nonconformity may require an additional visit to verify corrective action, which can add audit days and charges. Get the position in writing before you sign. -
05
What could change the price?
Ask what could change the price after Stage 1. Some quotes are fixed, while others are indicative. Confirm whether changes to the scope, the number of AI systems, or the audit findings can increase the fee, and whether the certification body charges for making those changes. -
06
Is the price fixed or indicative?
Check whether the figure is a fixed price for the stated scope or an estimate that may change. A low initial fee can look attractive but lead to a higher three-year cost if surveillance pricing or later adjustments are unclear.
What the quote does not include
The certification fee usually covers the audit and the certificate. It generally excludes the work needed to prepare your organisation for the audit.
That preparation may include consultancy, implementation support, training and governance software. Post-finding remediation is also usually separate. If the audit identifies nonconformities, you may need to pay for extra work inside your organisation before certification can be completed.
Your existing management system affects this part of the budget. An organisation starting from scratch will usually spend more on preparation than on certification itself. A business with an established ISO 27001 system may have less preparation work, although the certification body still needs to assess the ISO 42001 requirements in scope.
Ask how the body charges for follow-up work before accepting the quote. A major nonconformity may require a verification visit, and corrective-action checks can involve additional audit days. Certification bodies apply different fee practices, so clarify whether these visits and days are included. Once findings have been raised, clarification is less useful and the extra cost may already be unavoidable.
Questions people ask about ISO 42001 costs
Why do ISO 42001 certification quotes vary so much?
+
ISO 42001 certification costs vary because certification bodies price the work around your organisation, its scope and the AI systems covered. Organisation size affects the audit-day baseline, while the scope of the management system usually drives the final figure.
Individual quotations are reasonable for a new standard with limited published pricing. They make comparison harder, though. Only one of the eight bodies in this study publishes certification prices, so price transparency receives a separate score in the ranking.
Ask each body to separate its audit-day total from the day rate. Check whether Stage 1 and Stage 2 are billed separately, how the work is scoped, and which invoicing terms apply.
Is it cheaper if we already hold ISO 27001?
+
It may be cheaper overall if you already hold ISO 27001, especially where the certification body can combine the audits and reuse evidence from your existing management system. An integrated audit can reduce duplicated audit work and preparation time.
That does not guarantee a lower certification fee. The ISO 42001 scope, number of AI systems, organisation size and certification body's overheads still affect the quote. Ask whether the body can combine the audits, how many audit days it expects, and which existing controls it can use.
Check that the body holds accreditation for ISO/IEC 42001 itself. Accreditation for ISO 27001 does not automatically cover ISO 42001.
What should we budget for ISO 42001 preparation?
+
Budget for preparation separately from the certification fee. If you already run a suitable management system, your existing controls and evidence may reduce the work. Starting without one can make preparation cost at least as much as certification, and sometimes more.
The main cost may be your internal team's time. Consultancy or implementation support can add to the bill, alongside training and remediation work. Certification fees cover the audit and certificate, so ask each supplier to state clearly what its quote excludes.
Do cheaper certification bodies conduct worse audits?
+
A lower price does not prove that a certification body conducts weaker audits. Prices reflect the audit scope, expected audit days and the body's overheads. The research available on this market cannot establish the quality of any individual audit from price alone.
Before accepting a quote, check the body's accreditation for ISO/IEC 42001. Ask who will perform the audit, and examine the auditor's relevant experience and seniority. Compare the audit-day total as well as the day rate.
Can we spread ISO 42001 certification costs over three years?
+
You may be able to spread the cost across the three-year certification cycle, depending on the body's invoicing arrangements. Certification commonly follows a three-year cycle, with the work and fees distributed across initial certification, surveillance and recertification.
Ask whether Stage 1, Stage 2 and later surveillance audits are invoiced separately. Confirm the payment schedule and billing terms before accepting the quote.
Compare eight ISO 42001 certification bodies
See the indicative price for each body alongside its accreditation status and the way it scopes an ISO 42001 audit. The ranking makes it easier to compare like with like and build a shortlist before requesting quotes.