"How much does ISO 42001 certification cost?" is usually the first question, and it's a fair one. Annoyingly, the honest answer is another question: what AI do you actually have?
A 40-person consultancy using two off-the-shelf tools and a bank training its own credit models are both "getting ISO 42001", but they're doing very different projects. So instead of throwing out a number, here's how to work out ISO 42001 certification cost for your own situation, how long it takes and what happens at each step.
What drives the cost?
| Factor | Why it matters | How to keep it down |
|---|---|---|
| Number of AI systems | Each in-scope system needs its own risk and impact assessment | Start with the systems clients care about |
| Your role | Developers have more controls to cover than companies that only use AI | Be clear what you build and what you buy |
| Risk level | AI affecting patients, credit or hiring needs deeper assessment | Keep high-risk uses in sharp focus |
| Existing ISO 27001 | The management system is already running | Build on it, and avoid running two systems |
| Team and sites in scope | More people and locations mean more audit time | Define a tight scope first |
| Deadline | A fixed client date may need more consultant time each week | Start before you’re asked |
The three bills to budget for
1. Certification body fees
You pay the certification body for its Stage 1 and Stage 2 audits, then for yearly surveillance audits. Certificates generally run on a three-year cycle, as with ISO 27001, so ask for the three-year cost and not just the first audit. Confirm the body's accreditation for ISO 42001 specifically. It's a young standard, and ISO/IEC 42006:2025 now sets rules for the bodies that certify it. Check with EIAC or another IAF member accreditor.
2. Consultant fees
A consultant is optional. If you already run ISO 27001 and have someone who enjoys this work, you may need only light help. If AI governance is brand new to you, expert support tends to save time and avoid failed audits. Ask for a fixed fee, after a scoping conversation.
3. Your own team's time
This is the bill nobody sends you, so it gets forgotten. Your AI owners, IT, legal and data people will spend real hours on assessments, controls and evidence. Plan for it now, because it's usually what makes a project slip.
How long does ISO 42001 take?
| Stage | Typical time | What happens |
|---|---|---|
| Discovery | Week 0 | Understand how you use AI and why you want certification |
| AI governance assessment | Weeks 1–3 | Inventory of AI systems and a gap assessment |
| Policies, roles and risk method | Weeks 3–6 | AI policy, accountability and assessment methods |
| Assessments and controls | Weeks 5–14 | Risk and impact assessments, and Annex A controls put into practice |
| Internal audit and management review | Before the audit | Fix issues before the certification body arrives |
| Certification audit | Stage 1 and Stage 2 | An accredited body audits your AI management system |
In practice, that adds up to about four to six months for most organisations, and faster if you hold ISO 27001. Don't believe an offer of certification in a few weeks. The system needs time to run and produce records.
How to get ISO 42001 certification, step by step
List your AI. Include what you build, what you buy and what staff use on their own. I'd start this one today. Ask each department, and expect surprises.
Decide your scope. You don't have to cover everything. Start with what your clients care about.
Write a short AI policy, and name who is accountable.
Assess the risks, including bias, errors, security and misuse.
Assess the impact on people, following ISO/IEC 42005:2025.
Put controls in place from Annex A, which has 38 controls, covering data, models, suppliers and oversight.
Train people, because a policy nobody knows about doesn't count.
Run an internal audit and management review.
Pass Stage 1 and Stage 2 with an accredited body.
Is it worth it for your company?
Picture two companies. One sells an AI product to banks, and its buyers keep asking how models are governed. Certification may well pay for itself with a single contract. The other is a small services firm that uses a chatbot for drafting emails. For them, certification would be overkill. An inventory, a one-page policy and some rules on what data goes where would do the job for now.
Most companies are somewhere in between. If you're not sure, read why ISO 42001 is important, and start with an assessment. It's useful on its own, and it tells you what the rest would involve.
We support ISO 42001 certification in Dubai, Abu Dhabi and Sharjah, with a written scope and fixed consulting fee after a free call. We prepare you for the audit, while an independent certification body issues the certificate.
Comparing providers? See the Top 10 ISO 42001 Consultants in the UAE.
Book a free ISO 42001 call or talk to our team.
Frequently asked questions
How much does ISO 42001 certification cost in the UAE?
There's no fixed price. Costs include certification body fees, consultant fees if you use one, and your own team's time. They depend on how many AI systems are in scope, whether you build or only use AI, the risk level and whether you already hold ISO 27001.
How long does ISO 42001 certification take?
Most organisations take about four to six months from first assessment to certification. Those that already run ISO 27001 are usually faster, because the management system is in place.
How do you get ISO 42001 certification?
List your AI systems, define scope, write an AI policy, assess risks and impacts, put Annex A controls in place, train people, run an internal audit and management review, then pass Stage 1 and Stage 2 audits with an accredited body.
Can a consultant issue ISO 42001 certification?
No. A consultant prepares you, while an independent accredited certification body audits and certifies you. Be careful of anyone offering both.
Do we need ISO 27001 first?
No. ISO 42001 stands alone. But an existing ISO 27001 system makes it faster, because the two standards share the same structure.