Frequently asked questions about ISO 42001

Q: Which AI falls under the standard?

ISO 42001 uses a broad definition of AI. This includes: - Machine learning models - Deep learning / neural networks - Natural language processing (chatbots, translators) - Computer vision (image recognition) - Recommendation systems - Predictive analytics - Automated decision systems - Generative AI If a system learns autonomously, recognises patterns or makes decisions based on data, it probably falls under the definition.

Q: How long does it take to get certified?

This depends on your starting position: - Small and experienced: 4-6 months - Medium-sized: 6-9 months - Large or complex: 9-15 months If you already have ISO 27001, it can be quicker because you already have the governance structure in place. Read more in costs and timeline.

Q: What does ISO 42001 certification cost?

Indicative costs: These are indications. The exact costs depend on your organisation, the number of AI systems and the approach you choose.

Answers to the most frequently asked questions about ISO 42001 certification. The standard is available in the Netherlands through NEN and is closely linked to the EU AI Act .

General questions about ISO 42001

What exactly is ISO 42001?

ISO/IEC 42001 is the first international standard for AI management systems. The standard describes how organisations can develop, implement and use AI responsibly. It provides a framework for governance, risk management and continual improvement around AI.

The standard was published in December 2023 and was developed by ISO and IEC.

Is ISO 42001 mandatory?

No, certification is not legally required. However, the EU AI Act does set requirements for AI systems. ISO 42001 helps you meet many of those requirements.

In practice, customers, partners and regulators are asking for ISO 42001 more and more often. Especially in sectors where AI is critical (finance, healthcare, HR technology), the pressure to hold certification is growing.

Which organisations is ISO 42001 relevant for?

The standard is relevant for any organisation that develops, implements or uses AI. Specifically:

AI developers and tech companies
Organisations that use AI solutions for decision-making
IT service providers that supply AI
Government organisations that deploy AI
Companies in regulated sectors (finance, healthcare, HR)

The size of the organisation does not matter. A start-up with one AI product can certify just as well as a multinational.

What is the difference from ISO 27001?

ISO 27001 is about information security: protecting information against unauthorised access, loss or alteration.

ISO 42001 is about AI governance: responsible development and use of AI, impact on people, fairness and transparency.

There is overlap. AI systems process information. But the focus is different. Many organisations need both standards.

Which AI falls under the standard?

ISO 42001 uses a broad definition of AI. This includes:

Machine learning models
Deep learning / neural networks
Natural language processing (chatbots, translators)
Computer vision (image recognition)
Recommendation systems
Predictive analytics
Automated decision systems
Generative AI

If a system learns autonomously, recognises patterns or makes decisions based on data, it probably falls under the definition.

Questions about ISO 42001 certification

How long does it take to get certified?

This depends on your starting position:

Small and experienced: 4-6 months
Medium-sized: 6-9 months
Large or complex: 9-15 months

If you already have ISO 27001, it can be quicker because you already have the governance structure in place.

What does ISO 42001 certification cost?

Indicative costs:

Cost item	Small	Medium	Large
Implementation	€10,000-30,000	€25,000-75,000	€75,000-200,000
Certification audit	€6,000-12,000	€10,000-20,000	€15,000-40,000
Annual surveillance	€4,000-8,000	€6,000-12,000	€10,000-25,000

These are indications. The exact costs depend on your organisation, the number of AI systems and the approach you choose.

How long is the certificate valid?

The certificate is valid for 3 years. Each year there is a surveillance audit to check that you still comply. After 3 years a recertification audit follows.

Which certification bodies are there in the Netherlands?

The main certification bodies (CBs) in the Netherlands are:

DNV: issued the first Dutch certificate
BSI: accredited by the RvA (Dutch Accreditation Council)
TÜV: internationally known
Kiwa: Dutch certification body
LRQA: operates internationally

Choose a certification body that is accredited for ISO 42001.

Can I combine ISO 42001 with ISO 27001?

Yes, this is even recommended. The standards have the same structure (High Level Structure). You can:

Build one integrated management system
Carry out combined audits
Share many processes (governance, audit, review)

This saves time and money.

Questions about the ISO 42001 standard

How many controls does ISO 42001 have?

Annex A contains 38 controls divided over 9 domains:

Policies for AI
Internal organisation
Resources for AI systems
AI system lifecycle
Data for AI systems
Information for interested parties
Use of AI systems
Third-party relationships
Assessment of AI systems

You do not have to implement all the controls. You select them based on your risks.

What is an AI impact assessment?

The AI System Impact Assessment (AISIA) is a unique element of ISO 42001. You assess the impact of your AI on individuals, groups and society.

Questions you answer:

Who is affected by this AI system?
What are the consequences if the AI makes mistakes?
Are certain groups disadvantaged?
Can people understand the decisions?

What is the Statement of Applicability?

The Statement of Applicability (SoA) documents which controls you have selected and why. For each control you record:

Is the control applicable? Yes or no
Why or why not?
How has the control been implemented?

The auditor uses the SoA to assess whether your choices are logical.

Questions about ISO 42001 and the EU AI Act

Does ISO 42001 help with compliance with the EU AI Act?

Yes, significantly. ISO 42001 covers many of the requirements of the AI Act:

Risk management
Governance
Documentation
Impact assessment
Monitoring and logging
Training and awareness

However, ISO 42001 is not the same as AI Act compliance. The law also has requirements that the standard does not cover, such as the conformity assessment, CE marking and registration in the database.

Read more in EU AI Act and ISO 42001 and in the comparison ISO 42001 vs EU AI Act.

When do I have to comply with the AI Act?

The timeline (the high-risk dates are expected to be postponed through the Digital Omnibus package):

February 2025: Prohibited AI, AI literacy (in force)
August 2025: General purpose AI (in force)
December 2027: High-risk AI from Annex III (planned postponement from August 2026)
August 2028: High-risk AI in regulated products

Check the current dates in EU AI Act and ISO 42001.

Is my AI high-risk under the AI Act?

High-risk AI includes, among other things:

AI in medical devices
AI for access to education
AI for recruitment and selection
AI for credit assessment
AI in critical infrastructure
AI for law enforcement

Check the annexes of the AI Act for the full list.

Practical questions about ISO 42001

Do I need to hire a consultant?

Not mandatory, but often sensible. A consultant can:

Speed up the process
Bring in expertise
Help you avoid pitfalls
Guide the implementation

Especially if you have no experience with management systems.

Can I implement ISO 42001 myself?

Yes, if you:

Have enough time
Have experience with ISO standards
Have access to the standard
Have internal capacity

The standard can be bought from NEN or ISO.

What if I only have one AI system?

You can limit the scope to that one system. The management system is then smaller and simpler. The costs and lead time are proportionally lower.

Later you can extend the scope if you start using more AI.

Do I have to certify all my AI systems?

No, you decide the scope yourself. You can start with the most important or highest-risk systems. The scope does need to be logical and defensible.

How do I prepare for the audit?

Tips:

Make sure the documentation is up to date
Carry out an internal audit or pre-audit
Prepare employees for interviews
Gather evidence (risk analyses, training records, logs)
Know your own system