ISO/IEC 42001, published on 18 December 2023, is the first international management system standard for artificial intelligence. A consultant can help you build an AI management system and prepare it for audit. A consultant cannot certify it. Certificates come from certification bodies, and in the UK, UKAS accredits certification bodies to certify against ISO/IEC 42001. This guide sets out what a consultant can help with, six checks to run before you appoint one, and what the work should produce.
Contents
- What a consultant can help with
- First, be honest about whether you need it at all
- The six checks
- The accreditation position, stated with the conflict left in
- What a competent implementation actually produces
- The failures that produce findings at Stage 2
- Why this is worth getting right in 2026
- Questions
- If it is useful
What a consultant can help with
- Deciding whether ISO 42001 fits your situation, and setting the scope and boundary.
- Building the AI system inventory and the methods for AI risk assessment and impact assessment.
- Writing the Statement of Applicability, policies and procedures with your team, and correcting what your team writes.
- Preparing the evidence a certification body will sample, and testing readiness before your audit.
- Preparing the scope information a certification body needs to quote. The choice of body and the contract are yours.
What a consultant cannot do: issue your certificate, or carry out the clause 9.2 internal audit on a system it built. Goldline implements management systems, and separately carries out internal audits on systems others built. It never does both for the same organisation and scope.
First, be honest about whether you need it at all
ISO 42001 is appropriate for organisations that build AI systems, deploy AI in their products or operations, or procure AI from third parties in ways that create material organisational risk. It is less appropriate for organisations whose only AI exposure is using off-the-shelf tools such as email, productivity software or general-purpose assistants without building or deploying AI in their own services.
A consultant who reaches the scoping conclusion before hearing the answer is not scoping. This decision belongs at the start of an engagement, not after a contract is signed, and a good adviser will sometimes talk you out of the standard and into a narrower piece of work.
Where it does apply, the standard follows the same Annex SL high-level structure as ISO 27001 and ISO 9001, which is why organisations already holding ISO 27001 can extend into ISO 42001 with materially less effort, and why the certification process follows the familiar Stage 1 and Stage 2 model.
The six checks
1. Certification-audit experience, named
Ask directly: have you taken an AI management system through a Stage 2 certification audit, and which certification body ran it?
This is a harder question in 2026 than it looks, because the accredited certification population is small and new. It is still the right question, and a specific answer naming a body and a scope is worth more than a general claim of experience. Where the answer is that the consultant has taken management systems through Stage 2 under other standards and is applying that to a newer one, that is a reasonable and checkable position. It is only a problem when it is dressed up as something else.
2. Who actually does the work
Ask who delivers day to day, by name, and what they hold.
The pattern worth watching for is a credentialed practitioner who wins the work and a less experienced team who deliver it. There is nothing wrong with a team, but you should know which model you are buying and what proportion of the engagement the named person is present for.
3. Credentials, which are necessary and not sufficient
The implementer-level credentials in the UK market are ISO 42001 Lead Implementer and ISO 42001 Lead Auditor. They are different qualifications: the auditor credential demonstrates competence to audit an implementation, not to design one. ISO 27001 credentials alone do not qualify a practitioner to implement ISO 42001, though they are genuinely useful adjacent knowledge, and the strongest implementations tend to come from practitioners who also understand information security management and data protection.
Ask for the certification reference and verify it with the issuing body rather than taking the logo on the website. This takes two minutes and it is the cheapest check on this list.
But treat credentials as a floor. A certificate demonstrates that somebody passed an examination about a standard. It does not demonstrate that they have built a management system that survived contact with an auditor.
4. Independence, and this is the one that can invalidate the work
A consultant who will not tell you in writing which of implementation and internal audit they are excluded from doing for you afterwards has not understood the standard they are selling.
Here is why it matters, and the rule is not a matter of opinion.
ISO/IEC 42006:2025 was published in its first edition in July 2025. It sets out the requirements for bodies providing audit and certification of AI management systems, and it is the document accreditation bodies use when they assess a certification body's competence to certify against ISO 42001. It sits alongside ISO/IEC 17021-1:2015, the general requirements for bodies providing audit and certification of management systems.
ISO/IEC 17021-1 sets requirements for the competence and impartiality of certification bodies. The same principle applies to the people who build your system: they should not audit it.
Read that list from the buyer's side. The rules exist because a body cannot credibly assess a system it designed. The same logic runs down to the consultant: the party that builds your AI management system cannot be the party that performs the clause 9.2 internal audit on it, because the internal audit is one of the things the Stage 2 auditor will examine, and an internal audit conducted by its own author is not an audit.
Three practical consequences for your shortlist.
- A firm offering to implement your AIMS and certify it is offering something the framework does not permit. Goldline is not a certification body and cannot issue a certificate, and nor can any consultancy.
- A firm offering to implement your AIMS and then run your internal audit is offering something that will not stand up. Plan for two parties from the beginning: it is cheaper than discovering it at Stage 1.
- If your chosen consultant does both kinds of work, ask which one they are taking on for you, and get the exclusion in writing. A practitioner who holds both implementer and auditor credentials is more useful, not less, provided the line is drawn in the engagement letter rather than in conversation.
Internal audit competence is itself defined. ISO 19011:2018 has been withdrawn; the current text is ISO 19011:2026, fourth edition, published 27 May 2026. Anyone quoting the 2018 edition at you in the second half of 2026 has not looked recently.
5. Whether the price is published
Ask whether the firm publishes its prices. A firm that states its fees before a call is easier to compare. Goldline's prices are published on the pricing page.
6. What happens after the certificate
Certification is the beginning of an obligation, not the end of one. Surveillance audits follow, the management system has to keep running, and the internal audit has to happen again.
Ask what retained or managed support looks like after the certificate is issued, and what it costs. A programme that ends the week the certificate arrives leaves you carrying a system nobody has been resourced to operate.
The accreditation position, stated with the conflict left in
UKAS announced on 15 January 2026 that it had granted BSI the first UKAS accreditation for certification of AI management systems to ISO/IEC 42001:2023. BSI announced the accreditation on 17 November 2025. UKAS states that its pilot accreditation programme has concluded and that applications remain open.
On 28 October 2026, the UKAS directory listed five certification bodies under Artificial Intelligence Management Systems (AIMS):
- BSI Assurance UK Ltd
- ISOQAR Limited
- LRQA Limited
- NQA Certification Ltd
- TUV UK Limited
The list changes, so check the directory when you approach a body.
What a competent implementation actually produces
Whoever you engage, the outputs should be recognisable. A senior practitioner-led implementation should leave you with:
- A documented AI system inventory, with an impact assessment completed for each system in scope
- A Statement of Applicability with evidence for the Annex A controls included and a stated reason for those excluded
- An AI risk register with treatments documented and monitored, calibrated to AI-specific risk including bias, opacity, data quality and unintended consequences
- A policy framework covering the Annex A control objectives
- Governance structures that match how decisions are actually made in your organisation
- An evidence pack assembled to certification body submission standard
Audit-ready in 8 to 12 weeks for a single entity with up to 50 people in scope and a named owner giving about four hours a week. Larger or multi-entity scopes typically take 12 to 24 weeks to audit-ready. The certification body then sets its own Stage 1 and Stage 2 dates.
The failures that produce findings at Stage 2
The most common ISO 42001 failure is treating it as a documentation exercise rather than a governance implementation. Stage 2 auditors test whether the management system is operating, not whether the documents exist.
Specifically:
- Impact assessments completed as templates rather than as genuine assessments of each system
- Risk registers populated with generic AI risks rather than the risks your systems actually carry
- Statements of Applicability that cannot be evidenced, with controls marked as implemented and nothing behind them
- Governance structures on paper that do not reflect who really decides
- Internal audits conducted without genuine independence, which is the failure this guide has spent the most words on because it is the one that cannot be fixed by working harder
Why this is worth getting right in 2026
Three things are making the timing real rather than theoretical.
The EU AI Act. Regulation (EU) 2026/1744 amended the AI Act's application dates. High-risk obligations now apply from 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 for those classified under Article 6(1) and Annex I. The Act applies to providers placing AI systems on the market in the Union, whether they are established in the Union or in a third country. It also applies to providers and deployers outside the Union where the output of the AI system is used in the Union. The Act does not name ISO 42001, and certification is not a legal requirement under it.
Procurement. UK enterprise and public sector buyers are adding AI governance questions to supplier assessments, and a management system gives a documented answer to a question that otherwise takes a bespoke response every time.
Board accountability. Expectations of board oversight of AI risk are hardening in the same direction information security expectations moved under GDPR. A management system is the documented answer to a question boards are increasingly being asked.
Questions
What does an ISO 42001 consultant do?
Helps you scope, build and evidence an AI management system to the requirements of ISO/IEC 42001, and prepare it for a certification body's audit. That covers the AI system inventory, risk and impact assessment, the Statement of Applicability, policies, and the evidence an auditor will sample.
Can a consultant certify an organisation?
No. Certificates are issued by certification bodies. In the UK, UKAS accredits certification bodies for ISO/IEC 42001, and you can check which bodies hold that accreditation in the UKAS directory. Goldline is not a certification body and does not issue certificates.
Should the implementation consultant also conduct the internal audit?
No. The internal audit is one of the things the certification auditor examines, and an internal audit carried out by the people who built the system is not independent of it. Goldline does not carry out a clause 9.2 internal audit on a management system it implemented. Where Goldline built the system, the internal audit is carried out by an independent internal auditor appointed by Goldline, never by the team that built it.
What should an ISO 42001 implementation produce?
- A documented AI system inventory, with an impact assessment for each system in scope.
- A Statement of Applicability, with evidence for the Annex A controls included and a reason for each one excluded.
- An AI risk register, with treatments recorded and monitored.
- Policies covering the Annex A control objectives.
- Governance roles that match how decisions are actually made.
- Records showing the system operates, ready for a certification body to sample.
If it is useful
Goldline implements ISO 42001 and ISO 27001 management systems and separately carries out clause 9.2 internal audits, and does not do both for the same organisation and scope. The scope and prices for every service are published at goldlineconsultancy.co.uk/pricing. For a scoping conversation, Book a free 45 minute diagnostic. ISO 42001 guide · Pricing.
Sources, and the date each was read
- ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system, published 18 December 2023. Read at iso.org, 1 September 2026.
- ISO/IEC 42006:2025, Requirements for bodies providing audit and certification of artificial intelligence management systems, first edition, July 2025, 31 pages. Read at iso.org, 1 September 2026.
- ISO 19011:2026, Guidelines for auditing management systems, fourth edition, published 27 May 2026, 46 pages, superseding ISO 19011:2018 which is withdrawn. Read at iso.org, 1 September 2026.
- UKAS, ISO/IEC 42001 accreditation announcement, 15 January 2026, and AI management systems accreditation page, last modified 25 August 2026. Read at ukas.com, 1 September 2026.
- BSI announcement of UKAS accreditation for ISO/IEC 42001, 17 November 2025. Read 1 September 2026.
- Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744, read at eur-lex.europa.eu, 28 October 2026.
- UKAS directory, Artificial Intelligence Management Systems (AIMS) category, read 28 October 2026.