ISO/IEC 42001:2023 is the first international standard for an Artificial Intelligence Management System (AIMS). The standard describes requirements for the responsible development, implementation and use of AI systems within your organisation.
Organisations that develop or deploy AI systems - from tech companies to traditional organisations starting to use AI.
Small (up to 20 FTE)
Rule of thumb for SMEs: Count on €15,000 - €35,000 in the first year, then €3,000 - €7,000 per year.
Prices indicative, excl. VAT, including consultant and internal hours.
Full cost breakdown- Which AI systems, processes and departments are covered by the AIMS? If necessary, start with your most important AI applications.
- Take an overview of all AI systems and identify the risks. This is the heart of ISO 42001.
- Implement controls, establish policies, train employees, and document processes.
- Work under your AIMS for a minimum of three months. Auditors want proof that the system works in practice.
- Verify that everything is working and have management formally assess the AIMS.
- The certification body carries out the audit in two phases. If successful you will receive the certificate.
Your certificate remains valid during and after the switch. The new certification body takes over the certification for the same standard and within your existing certification cycle. There is no interruption in your certificate status.
SwitchingA surveillance audit every year. A full recertification every three years. Your certificate is valid for three years, provided you pass the annual audits.
RecertificationISO 42001 is the international standard for AI management systems (AIMS). It helps organisations develop, implement and use artificial intelligence responsibly. The certificate shows that you manage AI risks systematically.
No, ISO 42001 is formally voluntary. But more and more clients, insurers and tenders require it. For high-risk AI under the EU AI Act a quality management system is mandatory, and ISO 42001 can help meet that requirement.
ISO 27001 focuses on information security (protecting data). ISO 42001 focuses specifically on AI governance: developing, deploying and managing AI systems responsibly. The standards complement each other and share the same structure.
Yes. ISO 42001 and the EU AI Act overlap by 40-50%. The standard helps you meet requirements for risk management, data governance and documentation. It is no guarantee of full compliance, but it covers a large part of the requirements.
In the Netherlands, DNV and BSI have held Dutch accreditation for ISO 42001 since January 2025. Other certification bodies such as Kiwa and TÜV also offer it, but are still working on their Dutch accreditation.
Yes, you can switch at any time. Your new certification body takes over your file and plans a transfer audit. Your certificate remains valid during the switch.
Completed in 5 minutes. Then tailored quotations from certification bodies that suit you.
