Costs and timeline for ISO 42001
How much does it cost to get ISO 42001 certified? And how long does it take? The honest answer: it depends. You need an accredited certification body, checked by the Dutch Accreditation Council (Raad voor Accreditatie, RvA). We can still give realistic ranges.
The main cost factors
The total cost depends on a few factors.
Organisation size. More people, more processes, more AI systems and more audit days.
Number and complexity of AI systems. An organisation with one chatbot is different from a company with dozens of machine learning models in production.
Current maturity. Do you already have a management system (ISO 27001, ISO 9001)? Then you have a head start. Are you starting from zero? Then there is more work.
Internal capacity. Do you do it yourself or hire help? External advice costs money, doing it internally costs time.
Costs per organisation type
| Cost item | Startup/scale-up (10-50) | SME (MKB, 50-250) | Enterprise (250+) |
|---|---|---|---|
| Implementation (internal/external) | €10,000 - €30,000 | €25,000 - €75,000 | €75,000 - €200,000+ |
| Certification audit | €6,000 - €12,000 | €10,000 - €20,000 | €15,000 - €40,000 |
| Annual surveillance audit | €4,000 - €8,000 | €6,000 - €12,000 | €10,000 - €25,000 |
| Total year 1 | €16,000 - €42,000 | €35,000 - €95,000 | €90,000 - €265,000+ |
| Annually after that | €4,000 - €10,000 | €8,000 - €20,000 | €15,000 - €40,000 |
| Typical profile | 1-5 AI systems, lean organisation | 5-20 AI systems, several departments | 20+ AI systems, complex organisation |
Startups often implement faster because there is less legacy, but there is also less structure to build on. For SMEs the challenge is usually coordination: AI is spread across departments. Large organisations often benefit from existing structures (ISO 27001, a privacy programme), but the complexity and volume of AI make the process heavier.
These amounts are indications based on market information. Always request quotes from several parties for your specific situation.
Breakdown of the costs
Implementation costs
This is the work of setting up your management system. It includes:
Gap analysis (€2,000 - €10,000): Where are you now? What needs to happen?
Policy and documentation (€3,000 - €20,000): Writing the AI policy, procedures and working methods.
Risk and impact assessments (€5,000 - €30,000): Assessing the risks and impact per AI system.
Implementing controls (€5,000 - €50,000+): Actually putting the controls in place. This can require significant technical changes.
Training (€2,000 - €15,000): Training employees in AI governance.
Internal audit (€2,000 - €10,000): Testing your own system.
Audit costs
The certification body charges by audit day. The number of days depends on your organisation’s size and complexity.
Stage 1 audit (document review): 1-3 days Stage 2 audit (on-site audit): 2-8 days
The day rate is between €1,000 and €2,000, depending on the body and the auditor.
After certification, annual surveillance audits follow. These are shorter than the initial audit, usually 50-70% of the time.
Hidden costs
Do not forget to include these:
Internal time. Employees spend hours on the project. That time also costs money, even if it does not appear on an invoice.
Tooling. You may need software for risk management, document control or monitoring.
Changes to AI systems. The impact assessment may show that you need to change your AI. Adding logging, improving explainability, correcting bias.
Maintenance. A certificate is not a one-off investment. You need to keep the system up to date, carry out audits and keep improving.
ISO 42001 timeline
How long does it take from start to certificate?
Typical lead times
| Situation | Lead time |
|---|---|
| Small organisation, little AI, experience with ISO | 4-6 months |
| Medium-sized organisation, several AI systems | 6-9 months |
| Large organisation, complex AI portfolio | 9-15 months |
| Very complex, lots of legacy, culture change needed | 12-18+ months |
The critical factors
Availability of people. If the project team works on it part-time alongside their daily work, it takes longer.
Decision-making. Do you wait weeks for policy approval? Then the schedule slips.
Technical changes. Do your AI systems need changes? Then the lead time depends on your development capacity.
Auditor availability. Certification bodies have waiting lists. Book the audit well in advance.
Phasing
A typical process looks like this:
Months 1-2: Inventory and gap analysis Overview of AI systems, assessing the current situation, drawing up a project plan.
Months 2-4: Setting up the management system Writing policy, setting up governance, defining processes.
Months 3-5: Risk and impact assessments Carrying out the analysis per AI system, selecting controls.
Months 4-6: Implementation Putting controls in place, training people, finishing documentation.
Months 5-7: Internal audit and improvement Testing, addressing findings, correcting.
Months 6-8: Certification audit Stage 1 and stage 2, any corrections, certificate.
This is an ideal scenario with sufficient resources and focus. In practice, projects often run late because of competing priorities, unexpected findings or capacity problems.
Speeding up or slowing down?
What speeds up the process?
Existing ISO certification. ISO 27001 or ISO 9001 means you already have a management system. You add the AI elements.
Dedicated team. People who work on this (almost) full-time make faster progress.
External help. An experienced consultant can speed things up, especially if you have little experience yourself.
Limited scope. Start with some of your AI systems. You can expand later.
What slows down the process?
No overview of AI. If you first have to find out which AI you have, you lose time.
Lack of commitment. If the board does not cooperate, the project stalls.
Heavy technical debt. AI systems that are poorly documented or have no logging need changes first.
Resistance to change. If people see AI governance as bureaucracy, they work against it.
Return on ISO 42001 certification
The question is not only what it costs, but what it delivers.
Access to markets. More and more customers, especially in regulated sectors, require demonstrable AI governance.
Risk reduction. By managing risks systematically, you prevent incidents and the costs that come with them.
Preparation for the EU AI Act. The EU AI Act is coming. Those who start now will be ready when it applies.
Trust. A certificate tells customers, partners and regulators that you take AI seriously.
Efficiency. A structured approach prevents ad hoc solutions and duplicated work.
What the net return is depends on your situation. But for organisations for which AI is critical, the investment is usually easy to justify.
Next steps
- Read the step-by-step plan for the practical route
- Read about the requirements of the standard
- Understand how the certification audit works