You run a growing company, and a big customer is asking whether you have ISO 42001. The whole deal could turn on how you answer. In my view the answer has three parts. First, figure out why they are asking. Perhaps they only need documented alignment, or perhaps they want an actual ISO 42001 certificate. You need to know exactly what their requirements are. Second, let them know what you already have going for you. Let them know if you have other related certifications, like ISO 27001, and tell them that you are on track to get ISO 42001 if that is what is required. Third, bring in a consultant like Certify Consulting Group to run a gap assessment and chart your path to full compliance with the ISO 42001 standard.
ISO 42001 is the international standard for managing AI inside a company, which it calls an AI management system. In plain terms, it asks you to decide who owns your AI, how you assess its risks, and how you can show a stranger that those things happen. Certification is voluntary, and it comes from an independent certification body, not from ISO itself.
Start with why they are asking, because the answer changes the size of everything after it. Some customers want a certificate from an accredited certification body. More often they want documented alignment. That means an AI policy, a list of the AI in your product and your operations, and short assessments of how your AI features could affect their users. It also means records that show these controls actually run. The difference between the two is often months of work, so ask directly: do you need a certificate, or is documented alignment enough, and which parts of our business should it cover?
Next, tell them what you already have. If you hold ISO 27001, that carries over more than most people expect, because ISO 42001 uses the same structure: a policy, objectives, internal audits, management reviews and a method for assessing risk. If you have SOC 2, you can point to access control, change management and vendor review, but the management system pieces are mostly new. Companies with a working ISO 27001 system are often at the short end of the four-to-twelve-month range, if you are certifying.
What neither one covers is the AI itself: an inventory of your AI systems, assessments of impact on the people your features affect, where your training and evaluation data came from, and what you tell users about the limits. If you build on a model provider's API, that provider counts as a supplier you need to control. Those gaps are what is left to build.
Then say where you stand. In my view being on track means you have named an owner and scheduled a gap assessment. If you have not started the assessment yet, say this week that you have an owner and that you are booking it, and give the date once you have it. If you hold ISO 27001 or SOC 2, say so. If you hold neither, lead with what you do have, like an AI policy and your security questionnaire answers, plus the plan to begin.
Third, bring in a consultant. At Certify Consulting Group we run a fixed-fee gap assessment for $9,750. A gap assessment compares what you do today against every clause of the standard and every AI-specific control in its Annex A, which is the list of controls the standard sets for AI. It shows what your ISO 27001 or SOC 2 program already covers, and gives you a prioritized plan with an estimate of time and cost.
After the gap assessment, you build what is missing and run it long enough to produce records. Then you do an internal audit and a management review, where leadership looks at how the system is performing, and you fix what turns up. If you are certifying, an accredited certification body then audits in two stages. Stage 1 is a review of your documentation, and Stage 2 is an audit of how the system actually runs.
A certification body cannot consult on what it certifies, so the firm that helps you build the system and the firm that audits it are always different. We help you choose an accredited body and prepare for both stages. If you are certifying, I would book the certification body early, since auditor availability is often the longest wait.
None of this needs to wait for the gap assessment. Send your customer the question about certificate versus documented alignment, and name the person who will own the answer. Attach your ISO 27001 certificate or SOC 2 report if you have one. List every AI tool you build or buy, because any gap assessment starts there. When you are ready, the link to book a free call with us is in the description, and we can start from whatever documented alignment your customer asks for.
