ISO/IEC 42001:2023 · DIFC, Dubai Internet City and mainland Dubai
ISO 42001 Certification in Dubai
Intello’s ISO 42001 consultants in Dubai help companies that build or use AI put proper governance around it. We set up an AI management system (AIMS), run your AI risk and impact assessments, and prepare you for ISO 42001 certification, so you can show clients and regulators that your AI is under control.
- Built on our ISO 27001 experience
- 500+ clients
- 99% client satisfaction
What is ISO 42001 certification?
ISO/IEC 42001 is the international standard for an AI management system (AIMS). It sets out how an organisation governs the AI it develops, provides or uses: policies, roles, risk and impact assessments, data and model controls, and monitoring. Certification means an accredited body has audited that system.
| Standard | ISO/IEC 42001:2023, published December 2023 |
|---|---|
| Applies to | Any organisation that develops, provides or uses AI systems, of any size |
| Structure | Clauses 4 to 10, the same structure as ISO 27001, plus 38 Annex A controls |
| Certification | By an accredited certification body. ISO/IEC 42006:2025 sets the rules those bodies follow |
| Mandatory? | Not by UAE law as of November 2026, but increasingly asked for by clients and partners |
| Where we work | From our Dubai office in Al Qusais, on site anywhere in Dubai and remotely |
AI governance and ISO 42001 for Dubai companies
Dubai is moving fast on AI, and so are the rules around it. ISO 42001 gives Dubai companies one structure that answers regulators, clients and their own boards.
DIFC firms
DIFC’s data protection rules include Regulation 10, added in September 2023, covering personal data processed by autonomous and semi-autonomous systems such as AI.
Banks and finance
The Central Bank’s AI guidance note of February 2026 sets expectations for licensed financial institutions using AI.
Dubai Internet City and Dubai Silicon Oasis
SaaS and AI product companies whose enterprise clients now ask how their models are governed.
Selling into Europe
Dubai companies placing AI systems on the EU market fall under the EU AI Act. An ISO 42001 AIMS covers much of the groundwork.
Healthcare and Dubai Healthcare City
Clinics and health tech firms using AI for diagnosis, triage or administration, where errors carry real risk.
Government suppliers
Companies supplying AI-enabled services to Dubai government entities, which expect responsible, explainable AI.
Also available: ISO 42001 in Abu Dhabi · ISO 42001 across the UAE · ISO 42001 in Sharjah
Do you need ISO 42001 certification in Dubai?
ISO 42001 is usually worth it if any of these apply to you:
- You build or sell AI products, and clients ask how your models are governed
- You use AI on personal data in DIFC, or in decisions that affect customers
- You are a bank or finance company working to the Central Bank’s AI guidance
- You sell AI systems into the EU and need to prepare for the EU AI Act
- You already hold ISO 27001 and want to extend it to AI
- Your board wants a clear view of where AI is used and what could go wrong
Not ready for certification yet? Our AI governance consulting in Dubai often starts with an assessment: an inventory of AI use, the main risks and a short action plan. It is a useful step on its own and the first stage of ISO 42001.
What ISO 42001 implementation involves
Like ISO 27001, ISO 42001 has a management system (clauses 4 to 10) and a set of Annex A controls chosen based on your risks.
AI inventory and scope
A list of the AI systems you develop, provide or use, and which of them the AIMS covers.
AI policy and roles
An AI policy, clear accountability and the roles needed to oversee AI, approved by management.
AI risk assessment
A repeatable method to assess AI risks such as bias, errors, security and misuse, with a treatment plan.
AI impact assessment
An assessment of how each AI system affects people and society, following ISO/IEC 42005:2025.
Data and model controls
Controls over training data quality, provenance, model development, testing and change.
Third parties and suppliers
Due diligence on AI vendors and models you rely on, including large language model providers.
Monitoring and human oversight
How AI performance is monitored, when humans step in, and how incidents are handled.
Internal audit and review
An internal audit and management review before the certification audit, then yearly improvement.
Our ISO 42001 implementation in Dubai, step by step
A fixed path from your first AI inventory to certification.
- 1
Discovery call
We understand how you use AI, who is asking for ISO 42001, and whether DIFC, CBUAE or EU rules apply.
Week 0 · free
- 2
AI governance assessment
An inventory of AI systems, a gap assessment against ISO 42001 and a prioritised plan.
Weeks 1–3
- 3
Policies, roles and risk method
AI policy, accountability, risk and impact assessment methods, written with your team.
Weeks 3–6
- 4
Assessments and controls
Risk and impact assessments for each in-scope AI system, and the Annex A controls put into practice.
Weeks 5–14
- 5
Internal audit and management review
A full internal audit and management review, so issues are fixed before the certification body arrives.
Before the audit
- 6
Certification audit support
We help you choose an accredited certification body and support you through both audit stages.
Stage 1 and Stage 2
Companies that already hold ISO 27001 often move faster, because the management system is already in place.
What you get
- AI system inventory
- Gap assessment against ISO/IEC 42001
- AI policy and roles, approved by management
- AI risk assessment method, register and treatment plan
- AI impact assessments for in-scope systems
- Statement of Applicability for the Annex A controls
- Mapping to DIFC Regulation 10 and CBUAE guidance where relevant
- Internal audit report and certification audit support
Choose how we work with you
AI governance assessment
2–3 weeksBest for: Knowing where AI is used and what the risks are
- · AI inventory
- · ISO 42001 gap assessment
- · Action plan
Full ISO 42001 implementation
4–6 monthsBest for: Getting certified
- · AIMS build
- · Risk and impact assessments
- · Certification audit support
Ongoing AIMS support
YearlyBest for: Staying certified year after year
- · Internal audits
- · Surveillance audit support
- · AI risk register updates
Has a client asked how your AI is governed?
A 30-minute call is enough to map your AI use and tell you what ISO 42001 would take.
ISO 42001 vs ISO 27001 for Dubai companies
The two standards share the same structure and work well together. Many Dubai companies run them as one integrated system.
| ISO 27001 | ISO 42001 | |
|---|---|---|
| Focus | Security of information | Responsible development and use of AI |
| Key assessment | Information security risk assessment | AI risk assessment and AI impact assessment |
| Annex A | 93 controls | 38 controls |
| Typical driver | Clients, tenders, regulators | AI clients, DIFC and CBUAE expectations, the EU AI Act |
What affects the cost of ISO 42001 certification in Dubai
You get a written scope and a fixed fee after the discovery call. These are the factors that move it:
- Number of AI systems
- How many AI systems are in scope, and whether you build them or buy them.
- Your role
- Developer, provider or user of AI: developers have more controls to cover.
- Risk level
- AI that affects customers, health or money needs deeper impact assessments.
- Existing ISO 27001
- An existing ISMS shortens the project considerably.
- Regulatory mapping
- Mapping to DIFC Regulation 10 or CBUAE guidance.
- Certification body fees
- Paid directly to the certification body, separate from our fees.
Why Dubai companies choose Intello as their ISO 42001 consultants
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Management-system experience. ISO 42001 follows the same structure as ISO 27001, which we have implemented for years.
Security built in. AI risks include security risks such as prompt injection and data leakage. We cover both.
Local regulation. We map your AIMS to DIFC, CBUAE and other UAE expectations, not only the standard.
Dubai-based. Workshops on site anywhere in Dubai, with remote work in between.
Frequently asked questions
Is ISO 42001 mandatory in Dubai?
No. As of November 2026 no UAE law requires ISO 42001 certification. Companies get it because clients ask, because it shows regulators such as the DIFC Commissioner of Data Protection or the Central Bank that AI is governed, or to prepare for the EU AI Act.
How much does ISO 42001 certification cost in Dubai?
There are two costs: the consultant’s fee to build your AI management system, and the certification body’s audit fee. Both depend on the number of AI systems in scope, whether you develop or only use AI, and whether you already hold ISO 27001. We give a fixed fee after a free discovery call.
How long does ISO 42001 implementation take in Dubai?
Most companies take four to six months from the first assessment to certification. Companies that already run ISO 27001 are usually faster, because the management system is already in place.
What is DIFC Regulation 10?
It is part of the DIFC Data Protection Regulations, added in September 2023. It sets rules for personal data processed by autonomous and semi-autonomous systems, such as AI. DIFC firms using AI on personal data should map their AI governance to it, and an ISO 42001 AIMS is a good structure for that.
Can we combine ISO 42001 with ISO 27001?
Yes. Both use the same clause structure, so one integrated management system can cover information security and AI, with shared policies, internal audits and management reviews.
Do we need ISO 42001 if we only use AI tools like chatbots?
Possibly not certification, but you still need governance: knowing which tools staff use, what data goes into them and who is accountable. An AI governance assessment is often the right first step for AI users.
Can Intello certify us?
No. Certification comes from an independent, accredited certification body. We build and prepare your AI management system and support you through the audits.
Related services
Get ISO 42001 in Dubai, without the guesswork
Tell us a little about how you use AI. We will set up a free 30-minute discovery call.
What happens next
- 1We get in touch to arrange a call
- 2A 30-minute discovery call
- 3A written scope, timeline and fixed fee
Prefer to talk now? Call +971 55 355 6787