ISO 42001 certification cost & timeline
Start with the audit scope and a separate implementation budget. Schellman’s published FAQ puts numbers on the audit fees; Godot and Brookcourt Solutions provide named examples of elapsed certification journeys.
Published cost evidence
Each amount keeps its original currency| Activity | Published figure | What the figure covers | Source |
|---|---|---|---|
| Initial certification audit | USD $20,000s–$40,000s | Schellman’s typical initial Stage 1 + Stage 2 audit. The quote scales with scope and complexity. | Schellman · FAQ |
| Annual surveillance | USD $13,000–$20,000+ | Schellman’s typical annual surveillance fees in the subsequent surveillance years. | Schellman FAQ |
| Unaccredited certification package | EUR €1,950 or €2,950 net per year | KCERT's published package: up to five staff or five to 25 staff respectively, on a three-year contract including surveillance. KCERT states this route is unaccredited, so check that your customers accept it. | KCERT price guide |
| Foundation training | GBP £620 + VAT | ISOQAR’s remote foundation course. One day of training; separate from certification audits. | ISOQAR · Course listing |
Sources accessed 2026-11-11. Audit guidance, training and internal implementation effort belong in separate budget lines. Use a written proposal to establish your price.
Timelines with a named activity
| Case / activity | Reported duration | Context | Source |
|---|---|---|---|
| IBM Granite | Under three months | IBM reports the certification process for the Granite AI management system, with an existing governance programme and an audit by Schellman. | IBM announcement |
| Godot | About six months | SGS describes a journey covering AI risk assessment, monitoring, training and operating documentation for behavioral analytics and adaptive engagement systems. | SGS case study |
| Brookcourt Solutions | Nine months | SGS describes preparation led by Xcina Consulting, followed by the certification audit. The reported use of AI includes sales and marketing operations. | SGS case study |
| Darktrace | Eleven months working with BSI | Elapsed preparation and assessment time, reported in the organization’s own announcement. | Company announcement |
| Thomson Reuters | Ten months, including internal and external audits | Elapsed preparation and assessment time, reported in the organization’s own announcement. | Company announcement |
| KCERT unaccredited procedure | Typically six to eight weeks | KCERT’s advertised duration for its unaccredited route. | KCERT guide |
| Coalfire readiness workshop | One to two days | A facilitated readiness workshop with gap analysis. Plan the full programme against the named journeys above. | Coalfire · Service page |
Ask for a quote you can compare
- Specify the AI roles, services, products, headcount and sites inside your proposed scope.
- Describe existing management systems and the evidence you want to reuse.
- Separate readiness work, initial audits, travel, surveillance and recertification.
- Ask how nonconformity closure affects the decision date and what evidence the body expects before scheduling.
- Confirm the legal issuing entity and the current accreditation scope in the proposal.
Use the clause guide to organize the evidence, then compare certification bodies. Browse customer scope examples before treating a group-level certification statement as coverage of a particular product.