ISO 42001 certification in the UK
Reviewed by Alfred Obeng on .
ISO/IEC 42001 certification is awarded by an independent certification body after a two-stage audit of your AI management system. Goldline gets you ready for that audit and does not certify. Before you sign with any body, check on the UKAS register that it is accredited for ISO/IEC 42001 itself, and not only for other standards.
What the standard is
ISO/IEC 42001:2023 is the international standard for an AI management system. It was published in December 2023. It sets out what an organisation that develops, provides or uses AI must have in place to manage that AI responsibly: a defined scope, a policy, assigned responsibilities, an assessment of AI risks and of the impact of AI systems, controls, monitoring, an internal audit and a management review.
Like ISO 27001, it follows the common structure for ISO management system standards, with requirements in clauses 4 to 10. If you already run an ISO 27001 system, much of that structure is familiar, which is why many companies build the two together. Annex A lists 38 controls in nine control objectives. You decide which controls apply to you and record that in a Statement of Applicability, with a reason for every control you leave out.
Who needs it
The standard is voluntary. Nobody in the UK is legally required to hold it. Companies pursue it because a customer, a procurement team or an investor has asked how they govern the AI they build or use, and a certificate from an accredited body answers that question in one document. If your customer's questionnaire asks for an AI management certificate, ask them what they will accept before you start. A certificate from a body that is not accredited for the standard may not satisfy them.
ISO 42001 is not the same as compliance with a law. It does not make you compliant with the EU AI Act or any other regulation. It gives you a managed, evidenced way of working that supports compliance work, and the two are worth keeping apart when you describe what you hold.
How certification works
Certification is a decision made by a certification body, not by the consultant who prepared you. The process has the same shape as other management system certifications.
- You build and run the system. The scope is defined, AI risks and impacts are assessed, controls are in place and have operated long enough to leave evidence.
- You carry out an internal audit and a management review. The standard requires both (clauses 9.2 and 9.3), and the certification body expects to see them before it audits.
- Stage 1. The body reviews your documentation and readiness: scope, policy, risk assessment, the Statement of Applicability and whether you are ready for the full audit.
- Stage 2. The body audits whether the system is implemented and working, by sampling evidence and speaking to the people who run it.
- The decision and the certificate. If the body is satisfied, it issues the certificate. Any non-conformities have to be closed first.
- Surveillance and recertification. The body returns in later years to confirm the system is still running, and a full recertification audit follows at the end of the cycle.
The body sets its own Stage 1 and Stage 2 dates. On the Sprint we request quotations and dates from three UKAS-accredited certification bodies in week 1, so you know your audit dates early.
Who can certify you, and how to check
Three standards govern a body that certifies to ISO 42001. ISO/IEC 42001:2023 is the requirement. ISO/IEC 17021-1 sets the requirements for bodies that audit and certify management systems. ISO/IEC 42006:2025 adds requirements specific to bodies that audit and certify AI management systems, including what their auditors must know.
In the UK, the accreditation body is UKAS. UKAS announced its first accreditation for certification to ISO/IEC 42001 on 15 January 2026, so no UKAS-accredited ISO 42001 certificate could exist before then. More bodies are being assessed, so the list changes. Do not rely on a list on someone else's website, including ours.
Check it yourself in three steps:
- Open the UKAS register of accredited organisations and search for the body.
- Look at its schedule of accreditation and confirm that ISO/IEC 42001 appears on it. A body can hold UKAS accreditation for ISO 27001 or ISO 9001 and not yet for ISO 42001.
- Ask the body to confirm, in its quotation, that the certificate will be issued under that accreditation.
A certificate from a body accredited by another member of the international accreditation forum cannot be described as UKAS accredited. Some organisations sell ISO 42001 certificates without accreditation for the standard. Those will not satisfy a buyer who asks for accredited certification, and accreditation does not apply backwards if the body gains it later. Decide what your customer needs before you choose.
What Goldline does, and what it does not
Goldline is not a certification body and does not issue certificates. An independent, accredited body assesses and certifies.
Goldline prepares you for the audit. On the ISO 42001 Sprint that means scoping the AI management system, assessing AI risks and impacts, writing the policies and the Statement of Applicability, putting the controls and evidence in place, and running the internal audit and management review. The internal audit is carried out by an independent internal auditor appointed by Goldline, never by the team that built your system. We do not sell implementation and certification to the same organisation, and we do not audit a system we have built.
The ISO 42001 Sprint is £7,000 fixed, plus VAT for a single entity with up to 50 people in scope, one site or cloud hosted. It runs on your compliance platform if you have one, or in our UK-hosted GRC workspace at no extra subscription. The certification body charges its own audit fee, which you pay to it direct.
If you want ISO 27001 as well, the Integrated Sprint builds both as one management system for £12,500 fixed, plus VAT. If you are not sure you are ready to commit, the AI Governance Readiness Assessment is from £2,500 plus VAT and credits in full against a Sprint started within six months. Every Goldline fee is on the pricing page.
How long it takes
Audit-ready in 8 to 12 weeks for a single entity up to 50 people in scope. The certification body sets its own Stage 1 and Stage 2 dates. Larger or multi-entity scopes take longer, and the range depends on what you have already written down and how much of the work sits inside someone's day job. The same assumptions are set out for ISO 27001 in the article on how long ISO 27001 implementation takes.
Frequently asked questions
Sources, read on 20 October 2026: ISO/IEC 42001:2023 catalogue entry; UKAS news of 15 January 2026; ISO/IEC 42006:2025 catalogue entry; UKAS accreditation marks guidance.