Who Needs ISO 42001 Compliance? A Plain-English Guide for UK Tech Companies
Author
Rob Hall
CEO, Tempo Audits
Key Takeaways
- ISO 42001 is especially relevant to organisations that develop AI, build AI-powered products or rely on AI in critical or sensitive work.
- Your AI role - producer, provider, user or a combination - helps determine the audit scope, applicable controls and audit effort.
- Certification can cover a defined part of the organisation, such as an engineering team, when that scope accurately reflects how AI is managed.
Who Needs ISO 42001 Compliance?
Companies that develop AI systems, embed AI in products they sell, or use AI to make or materially influence decisions about customers or employees should take ISO 42001 seriously. Certification is especially relevant when AI is central to a product or service, carries significant risks, or customers expect clear evidence of how it is governed.
The deciding factor is how the organisation develops, provides or uses AI - not its size or sector alone. Headcount still affects audit effort and cost, but there is no universal threshold for when certification becomes necessary. In the UK, the Data (Use and Access) Act 2025 sets out changes concerning safeguards for significant decisions made solely through automated processing of personal data.
The government has also published recommendations for a future AI regulatory framework in healthcare. These developments do not make ISO 42001 certification mandatory, but they add to the need for clear, accountable AI governance.
How to Tell If Your Organisation is in Scope
These four checks can help you decide whether ISO 42001 certification belongs on your roadmap. They’re a practical starting point, not a formal eligibility test.
If two or more checks apply, it may be time to explore certification. That isn’t a rule in ISO 42001; it’s a useful prompt to look more closely. At Tempo Audits, a scoping conversation helps establish which AI roles and activities you want covered, who is involved and what audit effort to expect. Headcount affects audit duration, but your AI activities and proposed scope shape the conversation.
Come to your scoping conversation knowing which AI roles apply to you. If your aim is to show assurance over your software or AI product, think seriously about certifying only your engineering or product team. A reduced scope can achieve that goal while keeping your costs down.
Is ISO 42001 Mandatory?
ISO/IEC 42001 certification is voluntary. There is no general UK law requiring every organisation to hold it, and the EU AI Act does not make ISO 42001 certification compulsory. The Act sets obligations according to an organisation’s role and how its AI system is used. An AI management system can support good governance, but holding a certificate does not, by itself, prove compliance with the Act.
The commercial picture is developing. ISO 27001 is already familiar in procurement, but ISO 42001 has not yet become a standard requirement in the same way. At Tempo Audits, we are seeing the strongest interest from AI producers and companies building AI products, with additional attention from sensitive areas such as healthcare and policing. A specific request from a customer, investor or insurer may make certification commercially relevant sooner.
How Your AI Role Affects Scope and Audit Effort
The first scoping question is what your organisation does with AI. You might develop AI systems, build them into a product, use third-party tools, or do more than one of these. Those roles help Tempo Audits understand what activities and people need to be included in the audit.
Your roles and the number of people involved help determine audit duration. The scope also needs to reflect how your AI management system works in practice: which teams, processes and AI activities it covers. That is why many organisations combine roles, while some choose a carefully defined scope focused on a particular part of the business, such as engineering.
The most important factor is your AI role.
Do You Need ISO 27001 Before ISO 42001?
No. ISO 27001 certification is not a prerequisite for ISO 42001. You can build an AI management system and apply for ISO 42001 certification without holding ISO 27001.
If you already have a well-run ISO 27001 system, some of its foundations - such as management reviews, internal audits and corrective action - will be familiar. The standards address different risks, though, so ISO 27001 does not cover the AI-specific work required by ISO 42001.
If your organisation is pursuing both, Tempo Audits can audit them together as an integrated management system. Because the standards share some management system requirements, an integrated audit may reduce duplicated work.
Depending on your scope, it can save up to 20% of audit time, mainly by reviewing shared clauses together.
ISO 42001 vs ISO 27001 vs the EU AI Act
These three address different things. ISO/IEC 42001 sets requirements for an AI management system; ISO/IEC 27001 covers information security management; and the EU AI Act is legislation that assigns obligations according to an organisation’s role and how its AI systems are used.
AI companies often consider both ISO standards because information security and AI governance are related but distinct. ISO 27001 addresses how information is protected; ISO 42001 addresses how AI is governed across its lifecycle. The EU AI Act is a separate legal framework, and holding either certificate does not by itself establish compliance with it.
When Companies Typically Pursue ISO 42001 Certification
ISO 42001 is not yet a routine procurement requirement in the way ISO 27001 has become. But a few moments can make a formal AI management system more urgent.
These are prompts to assess your needs, not automatic reasons to certify. In a scoping conversation, Tempo Audits looks at your AI activities, risks and intended scope to work out whether ISO 42001 certification fits your business.
The UK Regulatory Picture for AI Governance
UK organisations need to consider existing legal and sector-specific duties alongside voluntary standards such as ISO 42001. Here’s how the ICO, government policy and FCA discussions fit into that picture.
ICO guidance covers AI and data protection
The Information Commissioner’s Office (ICO) explains how data protection law applies when AI systems process personal data, including expectations around fairness, transparency, accuracy and accountability. ISO 42001 can help an organisation document its AI governance, but certification does not prove compliance with data protection law or replace the ICO’s guidance.
UK policy recognises ISO 42001 as a useful standard
The UK Government’s AI regulation white paper identifies ISO/IEC 42001 as a standard that can help organisations develop or use AI responsibly. It does not make certification a legal requirement. Organisations still need to assess which legal duties apply to their activities.
FCA discussions include AI governance and assurance
At its 2025 AI Sprint, the Financial Conduct Authority brought together industry, academic and regulatory participants to discuss AI in financial services. The summary covers governance, accountability and assurance, and names ISO 42001 as an example of an international standard being developed and adopted. This reflects discussion, not an FCA requirement or endorsement.
How Long Does ISO 42001 Certification Actually Take?
Preparing your AI management system usually takes a few months. Once it is ready for audit, Tempo Audit's typical timeline is around one month from Stage 1 to certification, provided the audit progresses smoothly and any findings are addressed promptly.
Preparation takes longer than the audit
Before Stage 1, your organisation needs to define the scope of its AI management system, complete its risk assessment and prepare the required evidence. The time this takes depends on your AI activities, the system’s maturity and how much work is already in place.
The audit usually spans around a month
Stage 1 is a readiness review, typically completed in a day for smaller organisations. If the system is ready to progress, Stage 2 follows. Tempo Audits usually allows a two-to-three-week gap between the stages. This gives you time to address any areas of concern from Stage 1 before the main audit.
After Stage 2, the auditor completes the report and technical review. If there are non-conformities, you’ll need to submit an acceptable corrective action plan before certification can be issued. The quicker those actions are completed and approved, the sooner the process can conclude.
Your timeline depends on readiness and findings
A straightforward audit may reach certification in about a month from Stage 1. Gaps identified at Stage 1, corrective actions after Stage 2 or delays in providing evidence can extend that. We’ll discuss your scope and readiness before confirming the audit schedule.
ISO 42001 Compliance FAQs
Can you certify only your engineering team?
Yes, if the scope clearly defines the part of the organisation covered by the AI management system and includes the relevant people, activities and processes. Certification applies to the management system within that agreed scope, not to an individual AI product. We’ll assess the proposed boundaries before confirming the audit.
How much does ISO 42001 certification cost?
Initial certification costs £3,500 to £20,000 (approximately €4,095 to €23,400). Annual surveillance audits cost £1,600 to £9,000 (~€1,872 to €10,530 per year), and recertification costs £3,500 to £14,000 (~€4,095 to €16,380). The final fee depends on factors such as headcount, AI roles, scope and complexity.
How often are surveillance audits needed?
ISO 42001 certification runs on a three-year cycle. Surveillance audits take place during the first two years, with the first due within 12 months of certification. A recertification audit is then required in the third year to renew the certificate.
Can we use our existing GRC platform during the audit?
Yes. If your evidence is organised in a GRC platform, we can review it there where access arrangements allow. We can also work with evidence shared through tools such as Google Drive or Dropbox. You don’t need a particular platform; the key is making relevant records accessible and having the right people available.
Do certification fees include implementation or consultancy?
No. Our fees cover the independent certification audit and related certification activities. They don’t include implementation, consultancy, training or software. We don’t provide implementation or consulting support; if you choose to work with a consultant, we independently audit the resulting management system.
Rob Hall
Book a call
No forms, no faff – just a conversation and a quote. Prefer to skip straight to it? Fill out the application form and we'll get moving.
Alternatively, if you have all the details,
fill out this form here.