ISO 42001: Six AI Vendors Checked and a Readiness Plan From the Clauses

Six of the largest AI vendors have announced ISO 42001 certification since November 2024, and only 3 of them named the firm that audited them. None published how long audit readiness took. ISO 42001 certification is now a line item on trust pages, so the useful question is what sits behind the badge, and what your own team would have to build to earn one.

Short answer. ISO 42001 certification means an accredited third party audited an organisation's AI management system against ISO/IEC 42001:2023 and found it conforms. AWS, Google Cloud, Anthropic, Microsoft, Workday and ServiceNow hold it. Getting there means defining scope, running AI risk and impact assessments, selecting Annex A controls, then proving the system operates.

What ISO 42001 certification actually certifies

ISO/IEC 42001 is a management system standard. It sets requirements for how an organisation establishes, runs and improves the policies and processes that govern its AI systems. It was published on 18 December 2023 by ISO and IEC jointly.

The word that matters is "system". The audit does not test whether a model is accurate, fair or safe. It tests whether the organisation has a governed process for deciding those things, and whether that process runs as documented.

That is the same shape as ISO 27001 for information security. Both follow the harmonised management system structure, with requirements in clauses 4 to 10 and a reference set of controls in Annex A. A team that already runs ISO 27001 will recognise most of the scaffolding.

The difference between this certificate and a SOC 2 report is covered in detail in the analysis of what SOC 2 auditors now ask about AI. The short version is that SOC 2 attests that controls operated over a period, and ISO 42001 certifies that a management system exists and is maintained.

Certification versus conformance

Anyone can claim to "align with" ISO 42001. Certification means an accredited certification body audited the system and issued a certificate. Accredited means a national accreditation body, such as ANAB in the United States or RvA in the Netherlands, has assessed the auditor itself.

I would treat any trust page that says "aligned" without naming a certificate as a self-assessment. That is not a criticism. It is a different and weaker claim, and buyers should price it accordingly.

Who holds ISO 42001 certification among major AI vendors

We read the primary announcement for each vendor below and recorded only what the announcement itself states. Where a detail was missing, the table says so rather than filling it from a secondary source.

Read 12 October 2026. "Not named" means the public announcement omits it, not that no auditor exists. Certificates are usually available in each vendor's trust portal, often behind a login, and those were not reviewed.

AWS was first among the cloud providers to announce

AWS described itself as the first major cloud service provider to announce ISO/IEC 42001 accredited certification for AI services, on 25 November 2024. It is also the only vendor here that published the result of a later audit by name. AWS reported that its first surveillance audit, in November 2025, closed with no findings.

That second disclosure is more useful than the first. A certificate proves the system passed once. A clean surveillance audit proves it was still running a year later.

Microsoft disclosed the most about its audit result

Microsoft 365 Copilot first received the certificate in March 2025. Coverage of its 2026 audit reported zero non-conformities and zero improvement observations, and an expansion of scope from 2 AI systems to 3 with the addition of Copilot Studio.

The detail worth noticing is the scope change. A buyer who checked the certificate in 2025 and assumed Copilot Studio was covered would have been wrong for a year.

Who issued the certificates, and why the auditor matters

A certificate is only as credible as the body that issued it and the body that accredited the issuer. Two names recur in the public record.

Schellman, a Tampa-based compliance firm, announced in October 2024 that it had become the first certification body accredited by ANAB to certify against ISO 42001. That claim is Schellman's own, as reported by the trade press. AWS, Anthropic and Workday all name Schellman as their auditor.

BSI announced on 9 December 2024 that the Dutch accreditation body RvA had accredited it for the standard. It named KPMG Australia as the first organisation it certified, the month before.

The rules for the auditors arrived after the first certificates

ISO/IEC 42006, which sets requirements for bodies that audit and certify AI management systems, was published in July 2025. It sits on top of ISO/IEC 17021-1, the general standard for management system certification bodies, and adds AI-specific competence and audit requirements.

Every certificate in the table above was issued or announced before or around that publication. That does not invalidate them. It does mean early auditors worked from the general rules plus their own interpretation, and the next round of audits will run against a tighter specification.

My view is that a 2026 surveillance or recertification result carries more weight than a 2024 initial certificate. Ask for the most recent audit, not the original press release.

What ISO 42001 certification requires in clauses 4 to 10

The auditable requirements sit in clauses 4 to 10. Clauses 1 to 3 cover scope, references and definitions and are not audited. Each of the 7 auditable clauses produces evidence an auditor will ask to see.

The impact assessment is what makes this standard different

Clause 6.1.4 requires an AI system impact assessment. The organisation must assess and document how an AI system could affect individuals and society, including through foreseeable misuse, and feed the result back into risk management. Clause 8.4 then requires that assessment to be repeated, particularly after major changes.

No equivalent exists in ISO 27001. Security risk is about the organisation's assets. Impact assessment is about people outside the organisation who are subject to the system's outputs. That is the part most teams have never written down before.

Clause 6 asks you to plan the assessments. Clause 8 asks you to show you ran them again when something changed. A team that swaps a model provider, adds retrieval over a new data source, or ships an agent with write access has made a major change.

If the risk register still carries the date of the original assessment, the auditor has a finding. The change management link is, in my experience of reading audit findings in adjacent standards, the most common gap between a well-written programme and a certifiable one.

Annex A and the 38 controls behind an AI management system

Annex A lists 38 reference controls grouped under 9 control objectives, numbered A.2 to A.10. You do not have to implement every one. You select the controls your risk treatment needs, and record every inclusion and exclusion with a justification in a Statement of Applicability.

The 9 groups cover AI policies, internal organisation, resources for AI systems, assessing impacts of AI systems, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships.

Two groups deserve early attention. Data for AI systems (A.7) covers data quality, provenance and preparation, which overlaps heavily with the work in building an AI bill of materials. Third-party relationships (A.10) is where your own model vendors enter the picture.

An audit readiness sequence built from the ISO 42001 clauses

No vendor in the table published how long readiness took, so any month count you see quoted is a consultant's estimate. What the clauses do fix is the order. Some outputs are inputs to others, and doing them out of sequence means redoing them.

This is the sequence I would run, written for the person who has to make it happen rather than the person who signs the policy.

Step 1: Write the scope before anything else

Clause 4.3 requires a defined scope. Name the AI systems inside it, and state your role for each: developer, provider, or user of someone else's model. A narrow scope covering one product is certifiable and honest. A scope of "all AI" is unauditable in a first cycle.

Microsoft started with 2 systems and added a third a year later. That is the pattern to copy.

Step 2: Build the AI inventory and the risk method together

You cannot assess risk on systems you have not listed. Build the inventory of models, data sources, prompts and integrations for each in-scope system, then fix one risk method under clause 6.1.2: criteria, likelihood, severity and acceptance thresholds. Write the method once and apply it to every system.

Teams that already run an agent governance maturity assessment will find most of the inventory exists. The gap is usually the written method.

Step 3: Run impact assessments, then the risk treatment

Run the clause 6.1.4 impact assessment for each system, then the risk assessment, then select treatments. Only now can you write the Statement of Applicability, because it records which Annex A controls the treatment plan needs. Writing the Statement of Applicability first is the most common sequencing error, and it produces a document the risk register does not support.

Step 4: Operate the system, then audit it yourself

An auditor needs evidence that the system ran, not just that it was designed. Run at least one change through clause 8 reassessment, hold a management review under clause 9.3, and complete a full internal audit under clause 9.2 with findings closed through clause 10.2. Only then book the certification audit.

Where this argument is weakest

Three limits on this post, stated plainly.

First, the sample is 6 announcements from large vendors. Certificates are also held by consultancies, IT services firms and smaller software companies, and a public register of every ISO 42001 certificate does not exist in a form we could count. The "3 of 6" figure describes how large vendors announce, not how certification works.

Second, the standard itself is paywalled. Clause titles and the Annex A structure here were checked against several independent published summaries that agree with each other, not against the licensed text. Several of those summaries are from consultancies with something to sell. Before you build a programme, buy the standard.

Third, the case against certification is real. For a team that only uses AI tools and does not build or provide AI systems, a full AIMS may cost more than the assurance it buys. A smaller programme covering an inventory, a risk method and vendor due diligence gets most of the protection. I would only certify once a customer or regulator asks for the certificate by name.

There is also a regulatory caveat. Some practitioners describe ISO 42001 as a path to EU AI Act conformity, and we could not confirm from an official EU source that it holds harmonised status. Treat it as useful evidence, not as a presumption of conformity. The obligations themselves are mapped in the EU AI Act transparency checklist.

How to read a vendor's ISO 42001 certificate as a buyer

If you are on the buying side, the badge answers one question: did an accredited auditor find a functioning AI management system? It does not answer whether the product you are buying is inside that system.

Ask for four things in writing. The certificate itself with its scope statement. The name of the certification body and its accreditation body. The date of the most recent surveillance or recertification audit. And confirmation that the specific product, region and model you will use sits inside the stated scope.

Fold those four questions into your existing vendor review. The rest of that review is covered in the AI agent procurement checklist, and the comparison of how the three largest assistants handle governance controls is in the enterprise governance comparison of ChatGPT, Claude and Gemini.

One more stance. A vendor that published a clean surveillance result, as AWS did, has told you more than a vendor with a newer badge and no follow-up. Reward the disclosure in your scoring.

Frequently asked questions

Where to start this week

Write a one-page scope statement. List every AI system your team builds, provides or depends on, and mark your role for each one. Then circle the one system a customer has actually asked about, and make that your first scope.

If you are buying rather than certifying, send the four written questions above to your two largest AI vendors before their next renewal. The answers will show you whether their badge covers what you bought.

Related reading