Does ISO 42001 require AI systems to be tested?

Annex A of ISO/IEC 42001 includes a control on verifying and validating AI systems, and where that control is in your Statement of Applicability, which it usually will be for a company with AI in its product, the audit asks for evidence it was applied. This testing produces that evidence.

Do we need this if we already have penetration testing?

Penetration testing covers the application, the APIs and the infrastructure. It doesn't test how the model behaves under prompt injection, whether it leaks data, or what an agent can be steered into doing. The two are complementary, and the report maps to different controls.

Will it break our production system?

Testing runs against staging by default. Production is tested only with written consent, agreed time windows and a named contact on your side, all set out in the rules of engagement before anything starts.

What if we're not pursuing ISO 42001?

The report stands on its own as the answer to a customer's questions about your AI, and it maps to the ISO 27001 controls on secure development and security testing as well.

How long does it take?

About three weeks from the scoping call to the report for a single feature or an agentic system, then a retest within 30 days. Continuous evaluation takes four to five weeks to build.

Who does the testing?

A specialist tester working under Goldline's scope, rules of engagement and review. Findings are reviewed by Alfred Obeng before anything reaches you, and the mapping to the standards is written by Goldline.

Your AI gets tested before your customer tests it.

ISO 42001 expects your AI systems to be verified and validated, and your customers' security teams are starting to ask the same question. Goldline tests your AI features the way an attacker would, and the findings land in your ISO 42001 evidence, mapped to the controls, with a retest to close them.

A free 45 minute diagnostic, not a sales call
A fixed price, agreed at scoping
Findings mapped to ISO 42001 and ISO 27001 controls
A retest within 30 days to close them

Book the free 45 minute diagnosticPick a time that suits you. Bring the AI feature, the questionnaire or the customer email.Same-week availability

No sales pitch 45 minutes Senior practitioner

Loading the calendar

Open the booking page

Calendar not loading? Open Calendly directly

CISSP, ISO/IEC 27001 Senior Lead Implementer and Lead Auditor, ISO/IEC 42001 Lead Implementer and Lead Auditor, PMP.

What a policy can't prove

ISO 42001's Annex A includes a control on the verification and validation of AI systems. A certification audit is evidence-based: it asks for the records that show the testing happened, not a policy saying it will.

When a customer's security questionnaire asks how the AI in your product has been tested for prompt injection and data leakage, this report is the answer.

Penetration testing covers the application, the APIs and the infrastructure. It doesn't test how the model behaves in use, and that's where these findings come from.

WHAT GETS TESTED

What gets tested

Prompt injection

Direct and indirect, including instructions hidden in documents and web content the model reads.

Data leakage

System prompts, other customers' data and personal data appearing in outputs.

Excessive agency

What an agent can do with its tools, and whether it can be steered into doing it.

Guardrail bypass

Whether the limits you've set on the model hold when someone works to get round them.

Insecure output handling

Model output passed into code, queries and downstream systems without being checked.

Access control

Who and what can reach the retrieval sources and integrations behind the model.

Detection

Whether an attack would be logged and noticed.

Testing follows the recognised attack classes for AI applications, including the OWASP Top 10 for LLM Applications, and is delivered by a specialist tester under written rules of engagement.

How it runs

Scoping call

The scope agreed and a fixed price set.

Rules of engagement

Signed before testing starts. Testing runs against staging by default.

Threat model

Built with your team, so the testing goes where the risk is.

Testing

Three to five days.

One report

Findings with reproduction steps and fixes, mapped to ISO 42001 and ISO 27001 controls.

Retest

Within 30 days, to confirm the fixes hold.

THE FEE

Three ways to buy

Single AI feature

£4,500 fixed

A chatbot, copilot or assistant over defined data.

Agentic system

£8,500 fixed

Agents with tools, actions and multiple data sources.

Continuous evaluation

From £9,500 to build, then £1,500 a quarter

An automated test suite built around your product that runs on every release, with a quarterly review.

Prices exclude VAT. The fee is fixed at scoping and does not move. Capacity is two assessments a month.

Start with the free 45 minute diagnostic

Forty five minutes, no charge. You keep the one-page roadmap either way.

Book the free diagnostic

WHAT YOU GET

One document

An executive summary a director can read.
Findings by severity, with reproduction steps and fixes.
A mapping table to the ISO/IEC 42001 Annex A controls on verification and validation (A.6.2.4), deployment (A.6.2.5), operation and monitoring (A.6.2.6) and event logging (A.6.2.8), and the ISO/IEC 27001 controls on the secure development life cycle (8.25), security testing (8.29), logging (8.15) and monitoring (8.16).
A retest statement confirming which findings are closed.

Written for the evidence folder.

What this is not

Not a guarantee that the system is secure. The report states what was tested, and what was found, on those dates.
Not certification, which only an accredited certification body issues.
Not an independent audit where Goldline implemented your ISO 42001. In that case it is verification evidence, which your certification body audits.

Your AI gets tested before your customer tests it.

What a policy can't prove

What gets tested

How it runs

Three ways to buy

£4,500 fixed

£8,500 fixed

From £9,500 to build, then £1,500 a quarter

Start with the free 45 minute diagnostic

One document

What this is not

Common questions

Related services

ISO 42001 certification

ISO 42001 Sprint

ISO 42001 Internal Audit