How we research this list
Every score comes from five defined resources, seven published criteria and a clear rule about which resource can answer each criterion. We record the evidence behind every score-changing factor, then apply the same process to every certification body on the list.
The resources we research from
We use the same five evidence resources across every market and every list. None automatically outranks the others. Its value depends on the question it can answer, so each resource has defined uses within our research.
-
01
Governing body
An accreditation body, official register or equivalent authoritative source that can establish whether a business delivers a legitimate service. For ISO 42001, accreditation claims must come from the relevant governing body's record. -
02
First-party disclosure
Information the business publishes on its own website, owned media or documentation. This shows what the organisation says it offers, how it works and what information it chooses to make available. -
03
First-party statement
Information a business gives us directly that does not already appear in its published material or independent reporting. We record it as the business's statement and attribute it accordingly. -
04
Third-party report
Information from independent sources, including other businesses and media coverage. It can provide external reporting or opinion, but it does not replace the governing body's record where accreditation is concerned. -
05
Reviews
Public feedback from customers on a business's review profiles. We read the comments to establish what the customer experience relates to before using them, because a review about training, a standards purchase or customer service does not measure an ISO 42001 audit.
How we read reviews
Reviews are one of our five research resources, and they receive careful treatment. Review platforms rarely separate ISO/IEC 42001 audits from training, standards purchases, customer service or other activities. A headline star rating can therefore tell a buyer very little about the audit experience.
We read each review before deciding whether it belongs in the analysis. We then weight it according to its subject. A review of an ISO 42001 audit counts in full. An audit review for another standard counts at 70%, while a course or general comment counts at 10%.
We analysed 347 reviews across the eight bodies. The profiles below show what each review account actually contains, rather than presenting its headline rating as a measure of certification quality.
The full review analysis explains the method and publishes the scores: What 347 reviews say about ISO 42001 auditors
How we cite what we find
Every claim that changes a score has a numbered reference beside it. The number links to the source, so you can see what supports the finding rather than taking the wording on trust.
We label the evidence by its source. Each label identifies who owns it and what form it takes. Sources may include an accreditation body, the certification body itself or an independent party. Every listed body has at least three references.
Accreditation claims follow a stricter rule. Only the relevant accreditation body can establish accreditation. A certification body's webpage, press release or a directory entry cannot do that.
For ISO/IEC 42001, the current UKAS evidence is its published list of first-tranche bodies. UKAS has not published individual ISO 42001 register entries or individual AIMS schedules for these bodies. We label the first-tranche list as a UKAS record. Claims that we verified a UKAS AIMS register entry are inaccurate because no such entry is currently available to verify.
References also show when a source covers a different service. Review totals must relate to the service being assessed. For example, a profile may show 309 reviews overall, while all 309 concern vehicle inspections. Those figures cannot be presented as reviews of the body's ISO 42001 audit service.
The seven criteria for ISO 42001 auditors and certification bodies
These seven criteria apply to every list on this site. Together, they account for 100% of each score. The criteria stay the same across buyer types, while their weights change to reflect what matters most to startups, SMEs and enterprise organisations.
Accreditations
Which accreditations the body holds, and from whom. UKAS, ANAB, RvA and JAS-ANZ are IAF signatories, so their certificates travel. Accreditation for ISO 42001 itself carries most of the mark. Accreditation for related standards, ISO 27001 above all, carries some: the impartiality checks and audited processes already exist, and a 42001 audit usually runs alongside them. Membership of a trade body counts for nothing.
Reviews
What clients say about the audit itself, read on every public profile the body has. A review of an ISO 42001 audit counts in full, an audit for another standard at 70%, a course or a general comment at 10%, the shop and invoices not at all. Then rating, volume and recency, on a method published in full on the reviews page. No reviews scores zero, which is a finding.
Pricing
Three checks. Transparency: does the body publish what certification costs and what is included. Proportionality: does it explain how audit days are sized to AI risk, or does a template apply regardless. Value: what you get for the money, which can only be judged where prices are published, so a body that publishes nothing scores on the first two and the card says so.
Responsiveness
Not the certificate turnaround alone. Speed is sometimes the deciding factor and usually is not; the thing buyers notice is whether a body replies, whether it can start when they need it to, and whether dealing with it costs them time. So this reads what a body publishes about lead times and booking, and what clients say about being answered. A body publishing a commitment scores above one relying on testimony, and one doing neither scores at the midpoint by default rather than by evidence.
Leverage of software/tooling
Two halves, both asking whether the audit fits how you already work. Your side: does the body take evidence from the software, platform and tools you already run - the model registry, the evaluation records, the ticket history, the document store - or does it ask you to gather all of it again by hand in spreadsheets or other formats. Its side: what it runs itself, whether that shortens the work or only moves it, and whether its people can read an AI system without being walked through it. A body scores well when the same audit costs you less time than it would elsewhere and it can show why. It scores badly when AI expertise is a page on the website with nothing behind it.
Auditor reputation
Standing a buyer can check, not standing a body asserts. Four things: how long it has certified management systems; which accredited ISO 42001 certificates it has actually issued, named and dated; whether it publishes clients or case studies for AI work; and what it says publicly about who will conduct your audit. Institutional age on its own is deliberately not the measure - every other criterion here scores what a body publishes and a reader can verify, and age is the one thing a buyer cannot check against anything and a body cannot influence. A long history with nothing to show for it on this standard scores in the middle.
Integrated audits
The ability to handle several related audits for the same client together. Most buyers hold a single standard, and for them this column changes nothing. For the ones already running an integrated management system it is frequently the criterion that settles the choice. What we look for is whether a body treats ISO 42001 as an addition to what a buyer already maintains: mapping it onto the existing controls, documents and risk work; taking the shared evidence from where it already sits instead of asking for it a second time in a different format; and aligning the surveillance and recertification calendar so two certificates do not run on separate cycles. Auditing both standards together in one visit is the clearest sign of it and the easiest thing to verify, but a body that audits separately while still working from your existing system scores better than one that audits together and insists on a parallel set of everything.
How we assess a body
We set seven criteria specific to ISO/IEC 42001 certification and assign each a fixed weight. They cover matters a buyer can check, including accreditation, pricing, responsiveness, reviews, auditor reputation, software and tooling, and integrated audits. We choose criteria for their usefulness and verifiability, rather than for the claims providers make most often.
Each criterion has its own valid evidence sources. Accreditation information comes from the relevant accreditation body, while a report's usefulness is assessed from the people or organisations that received it. Using the wrong source can turn a comparison into a ranking of marketing claims, so the source rules form part of the method.
We check accreditation registers, provider websites, direct responses, independent reporting and public review profiles. We record the date for every source used. If a provider has published no information on a point, that absence is recorded as a finding. It is not treated as proof that the underlying service does not exist.
We send unresolved questions from the public record to the certification body. The question, any response and the date are recorded. If the body does not reply, the entry says so. A direct statement can add evidence, but it remains attributed to the provider.
Each criterion receives a score from 0 to 10. The score compares the eight bodies in this study, so it is relative rather than absolute. A 10 means the strongest performance against that criterion within this market. It does not mean perfection, and a lower score does not by itself mean a body delivers poor audits.
We combine the seven scores using the published weights to produce an overall result out of 10. Each page includes its publication date, and every scored claim has a supporting reference. The startup, SME and enterprise pages reuse the same underlying scores and change only the weighting. If totals tie, the higher score on that page's heaviest criterion decides the order. Any remaining tie is settled alphabetically by body name.
We review accreditation-body publications each month and carry out a full review of every entry each quarter. The page flags evidence that has aged. We do not silently retain expired dates or leave an outdated record looking current.
What qualifies a body for the list
A certification body must hold, or be pursuing, accreditation to certify against ISO/IEC 42001. The accreditation must be publicly verifiable through the relevant accreditation body or an equivalent governing record.
That rule excludes consultancies and firms accredited only for other standards. A consultancy may help an organisation prepare for certification, but it cannot audit that same client. A firm accredited for ISO 27001, for example, is not automatically accredited to certify ISO/IEC 42001.
The requirement is simple to state and difficult to fake. It also makes the list shorter than many directories using the search term "ISO 42001 auditors". A list of twenty organisations may include firms that offer consultancy or preparation services but cannot issue an ISO/IEC 42001 certificate.
We do not require a minimum number of completed ISO/IEC 42001 audits. The standard was published in December 2023, and UKAS granted its first accreditation for it in 2026. No organisation has ten years of experience certifying against ISO/IEC 42001. Claims that use a decade of experience as a filter should therefore be treated with caution.
Independence, money and corrections
You do not pay to be in this study. Every certification body accredited for ISO/IEC 42001, or going through accreditation for it, goes into the ranking whether it has ever spoken to us or not. Most of these eight never have.
What a body can pay for is participation. A listing keeps its entry current on the monthly re-check, gives it a route to tell us what our research cannot reach, such as a price it does not publish or a lead time it has never stated, and at the top tier shows it the calculation behind each of its seven scores. That is what the fee covers: the work of taking in what a body tells us, checking it, weighing it as a second-party source and recording who said it.
What payment never buys is a position. Not a rank, not a score, not the wording of an entry, including the line about what buyers should watch for. The criteria and the weights are published, so any ranking can be checked against the method rather than taken on trust.
Disclosure cuts both ways. A body that tells us something unflattering gets it recorded, and the score moves if the evidence warrants it.
We take no free audits, no discounts and no hospitality from listed bodies, and we hold no shareholding in any of them.
If you believe an entry contains an error, email the correction with supporting evidence. We review corrections within two working days. When we change a page, we record the change and its date.
A body can dispute a score. Where appropriate, we publish its response alongside the entry as a right of reply. We do not remove an accurate finding because a body objects to it.
Questions people ask
Why is your list shorter than everyone else's?
+
Most lists include consultancies. A consultancy prepares an organisation for certification, but accreditation rules prevent it from auditing a client it has prepared.
That separation matters because certification follows an audit by a certification body. Only the organisation conducting that audit can issue the certificate. Preparation and certification are separate purchases, so this list includes bodies that can certify you rather than firms that only help you get ready.
Can a body pay to rank higher?
+
No. A body cannot pay for a higher score, ranking position or more favourable wording.
Paid, labelled placements are available, but they sit outside the scoring decision. Scores come from the seven published criteria, and the rankings follow the published weightings. You can check each result against the methodology and the evidence cited alongside the entry.
Why does a body score badly for not publishing its prices?
+
The score reflects what a buyer can find without making an enquiry. If a body publishes no prices, buyers cannot compare its costs, inclusions or pricing method at the point they begin their research.
That does not mean the body is expensive. It means the public evidence is limited, and the pricing criterion measures transparency as well as value. The score uses information available to buyers, rather than information the site cannot see.
How do I challenge a score?
+
Email the correction with supporting evidence. We review corrections within two working days.
If a body disagrees with a score, it can submit a response. We publish that response alongside the entry. Where a correction changes the page, we record the change and its date rather than editing it silently.
Do you accept free audits or trials?
+
No. We do not accept free audits, free trials, services, discounts or hospitality from listed bodies.
We take no benefits from the certification bodies we assess. Their scores come from the published criteria and the evidence recorded against them.
Who runs this site
ISO/IEC 42001 was published in December 2023 as the first certifiable management system standard focused on artificial intelligence. By 2026, only a small number of certification bodies could issue certificates against it.
Search results were harder to use. They mixed accredited certification bodies with consultancies, security testers and software vendors. Some rankings also used criteria that were not published, including one that expected five years of ISO 42001 auditing experience when the standard was less than three years old.
We created this directory to make the shortlist more useful. It includes organisations that can issue ISO/IEC 42001 certificates, and scores them against criteria a buyer can check. Each entry shows when its information was last verified.
Sarah Rice
Editor
Sarah Rice is a PR specialist & digital marketing expert who has spent more than 30 years working with SEO & GEO agencies, PR agencies and brands across a huge range of sectors. She is Director of Rice PR and Director & Editor of The HR World. Earlier in her career, she was Head of Public Affairs and Press Manager at RAC and Head of Campaigns at JBP, and has also worked with DC Thomas and a number of charities.
- Director, Bristol Women in Business Charter
- Masters, Creative Writing
The rules we hold ourselves to
-
01
Every claim carries a source
If we cannot cite it, it does not go on the page. Where a fact is unverified the entry says so rather than rounding it up. -
02
Accreditation comes from the accreditation body
Its register where one exists, and its own published record where the programme is too new for register entries. Never a press release, and never a certification body’s own marketing. -
03
Every entry carries a date
The day we last checked it. An undated review is an assertion about the past pretending to be current. -
04
Paid means labelled
On the page it appears on, in plain words, every time. -
05
Corrections in two working days
With the change and its date published, not quietly edited in. -
06
We publish what is wrong as well as what is right
A body with no published prices, or an accreditation that does not cover this standard, gets that written down. A review with no downsides is an advert.
Run a certification body?
Listings are free. Paid placement carries a label and never moves a score.