Accredited certification exists
UKAS granted BSI the first UK accreditation for certification to ISO/IEC 42001:2023 (UKAS news item, 15 January 2026). A certificate can now carry a UKAS mark, which is what an enterprise reviewer checks.
FOR AI STARTUPS UNDER 50 PEOPLE
Startup Compliance Sprint.First 30 days free. Flexible payments.Built for AI startups. Leicester-based.
ISO 27001, ISO 42001, SOC 2 or both ISO standards on one system, at a fixed published price.
- Free 45-minute diagnostic and a one-page roadmap, yours either way
- First 30 days free, then the fixed fee quarterly or monthly
5-star client reviewsRead them on G2
GRC platformPartnerBook the free 45-minute diagnosticBring the customer email, the investor's list or the questionnaire. You leave with a one-page roadmap either way.Same-week availability
No sales pitch 45 minutes Senior practitioner
CISSP, ISO 27001 Lead Implementer and Lead Auditor, ISO 42001 Lead Implementer and Lead Auditor, PMP.
What is your customer asking for?
- A certificate (ISO 27001 or ISO 42001)The Startup Compliance Sprint
- Answers to a security questionnaireFirst Security Questionnaire
- Alignment with ISO 27001, not a certificate yetThe ISO 27001 Alignment Pack
- A bank or insurer's supplier reviewRegulated-buyer evidence
- A tender asking for ISO 27001, Cyber Essentials Plus or SOC 2Your bid evidence, ready
- Questions about how our AI uses their dataAI and data questions
- A SOC 2 reportThe SOC 2 Sprint. The report comes from an independent CPA firm.
- Not sure yetThe free 45-minute diagnostic
Trusted by
THE OFFER AT A GLANCE
30 days
free at the start
Stop within 30 days of the start date and you owe nothing.
£7,000
ISO 27001, ISO 42001 or SOC 2 Sprint
Fixed, plus VAT. Integrated ISO 27001 plus ISO 42001 at £12,500.
Quarterly or monthly
flexible payments from day 30
Agreed on the diagnostic.
Under 50
people, single entity
One site or cloud hosted. Larger scopes are scoped on the free diagnostic.
Prices as published at /pricing, excluding VAT. The CPA firm's fee for a SOC 2 report is separate and paid to the firm.
Doing it alone vs the Sprint
Doing it alone
- Nobody to tell you which controls apply to your product and your AI systems.
- Policies written from scratch for one questionnaire, then again for the next.
- Templates bought, then rewritten once an auditor asks questions.
- Security and AI governance run as two projects.
- Founders' time spent on compliance rather than the product.
The Sprint
- Goldline scopes it on the free diagnostic and builds the management system with you.
- Policies, controls and evidence built once and reused for every ask.
- ISO 27001 and ISO 42001 built as one system where you need both; SOC 2 readiness on the same evidence if you sell to US customers.
- First 30 days free, then flexible payments.
- Set up on a GRC platform, licence bought direct, with a trust centre set up on the platform.
- Internal audit via our partner; an independent certification body assesses.
Free diagnostic first. You get a written roadmap whether or not you go ahead.
How it works
Planned timings for a single entity under 50 people. The independent body sets its own audit dates.
STEP 01
Free 45-minute diagnostic
We agree the standard, the scope and how you'd like to pay. You keep the one-page roadmap.
STEP 02
First 30 days free
Work starts straight away. Stop within 30 days and you owe nothing.
STEP 03
Flexible payments from day 30
Quarterly or monthly, agreed on the diagnostic.
STEP 04
Audit-ready in 8 to 12 weeks
Planned timing for ISO 27001 and ISO 42001, single company under 50 people. The certification body sets its own audit dates. SOC 2 timing is agreed on the diagnostic.
Why now
The EU AI Act has dates
Article 50 transparency obligations have applied since 2 August 2026. Annex III high-risk obligations apply from 2 December 2027 under the Digital Omnibus. They matter only where EU users are in the mix.
One structure, two standards
ISO/IEC 42001 uses the same management system structure as ISO/IEC 27001: clauses 4 to 10 line up, so a startup builds the system once and extends it, rather than running two.
ISO 42001 is a management system standard. It is not a compliance route to the EU AI Act and it does not discharge a duty under it. Goldline is not a certification body; the certificate comes from an independent, accredited body you choose.
Choose your standard
ISO 27001
£7,000
Flexible payments
For customers asking for security assurance.
ISO 42001
£7,000
Flexible payments
For AI governance.
SOC 2
£7,000
Flexible payments
For selling to US customers.
Readiness through to a Type 1 report. The CPA firm's fee is separate and paid to the firm.
Integrated ISO 27001 plus ISO 42001
£12,500
Flexible payments
For AI startups that need both.
All plus VAT. First 30 days free, then the fixed fee quarterly or monthly from day 30, agreed on the diagnostic.
An explanatory model of the two standards' structure, not the standards' text.
What's in the package
Six parts, delivered with you over the Sprint. Parts 01 and 02 start straight away, inside the free first 30 days.
Kickoff, scope and gap assessment
We agree the standard, the scope and the timeline in a focused kickoff, then review what you already do against the standard and turn the gaps into a dated remediation roadmap.
First 30 daysSet up on a GRC platform
We set up a GRC platform for your standard and connect the integrations your systems support, so evidence is collected in one place as each control goes live. Where the platform needs a licence, you buy it direct from the vendor.
First 30 daysPolicies and the management system, built for you
Policies, the risk assessment and the control documentation your standard asks for, written around how your company actually works rather than copied from a template.
Trust centre
A customer-facing trust centre page showing the policies and controls you choose to share, so there's one link to send when a prospect asks about your security.
Internal audit via our partner
Before the external audit, our audit partner, independent of the team that built your system, audits it, so you can close any findings while they're still private.
Readiness review and support through the certification audit
A written summary of where you stand and what's left, then support through the certification audit and any findings. For SOC 2: through the CPA firm's examination. The certification body or the CPA firm makes its own decision.
One legal entity, up to 50 people in scope, one site or cloud hosted.
Is this you?
- Under 50 people, one legal entity
- A customer, an investor or a tender has asked, or is about to
- AI in your product, or ISO 27001 on its own if not
- A named owner who can give it four hours a week
Founder FAQ
Goldline never sells implementation and certification to the same organisation for the same scope. The internal audit in every Sprint is carried out by our audit partner.