Cost guide · Published October 19, 2026
ISO 42001 Certification Cost in 2026, Line by Line
Certifying your organization means paying an accredited certification body for a two-stage audit, then a surveillance audit in each of the next two years. Schellman, a certification body, publishes a year-one range from the $20,000s to the $40,000s and $13,000 to $20,000+ for each surveillance year. Preparation, training, and the standard sit on top.
Two different costs
Read this before comparing prices
Certifying a company and certifying a person are separate purchases.
Five of the top ten Google results for this search on October 19, 2026 were about courses. A course gives one person a credential. Only an accredited certification body can certify your organization’s AI management system. The audit alone costs several times more than the most expensive course listed here, so check which one a price refers to.
Your organization
AI management system certification
$20,000s to $40,000s
Year-one Stage 1 and Stage 2 audit, as published by Schellman, plus $13,000 to $20,000+ for each surveillance year. Smaller teams may see lower quotes: Vanta’s illustrative table starts at $5,000 for 1–20 stakeholders.
Paid to: an accredited certification body
One person
Lead auditor or lead implementer course
$589 to $2,730
From PECB’s self-paced Lead Auditor eLearning with the exam included to BSI’s four-day live online course, as listed on October 19, 2026. Compare the courses.
Paid to: a training provider
Line by line
Every figure links to where it was published
What a first three-year cycle can include.
ISO does not publish cost benchmarks, and few certification bodies publish prices. Schellman is the exception we found, so its figures anchor the audit lines. Ranges from compliance software vendors are labeled as theirs. They sell products that promise to lower these costs, which is worth keeping in mind.
| Line | Paid to | Published figure | Source and note |
|---|---|---|---|
| Stage 1 and Stage 2 certification audit (year 1) | Accredited certification body | From the $20,000s up to the $40,000s | Schellman FAQ, updated June 23, 2026Schellman’s own published range. Vanta’s “illustrative” table shows $5,000 for 1–20 stakeholders and $7,000 for 21–50. |
| Surveillance audit, year 2 | Same certification body | $13,000 to $20,000+ | Schellman FAQVanta’s illustrative figures: $2,500 (1–20 stakeholders) or $3,500 (21–50). |
| Surveillance audit, year 3 | Same certification body | $13,000 to $20,000+ | Schellman FAQSame range as year 2 in Schellman’s FAQ. |
| Recertification audit (starts the next three-year cycle) | Certification body | No certification body figure found | Scytale estimate: 60–70% of the initial audit feeScytale sells compliance software. Treat this as an estimate and ask each body for its recertification price in writing. |
| Gap or readiness assessment (optional) | Consultant or the certification body’s pre-audit service | $3,000 to $10,000+ | Vanta, which calls its figures anecdotalScytale puts external gap assessments at $3,000 to $15,000. |
| Implementation help (optional) | Consultant | $10,000 to $40,000+ | VantaScytale puts full implementation support at $20,000 to $80,000. |
| Your team’s time | Internal payroll | 200 to 400 hours for a 50-person company | Scytale estimateScytale converts this to roughly $30,000 to $60,000. Use your own loaded hourly cost instead. |
| Training one internal lead | Training provider | $589 to $2,730 | PECB eLearning (Mindset Cyber) and BSI listingsSelf-paced eLearning at the low end, a four-day live course at the high end. Details in the course table below. |
| The standard itself, ISO/IEC 42001:2023 | ISO or a national standards store | $369 PDF (ANSI store); CHF 225 from ISO | ANSI WebstoreANSI members pay $295.20. ISO lists the 51-page standard at CHF 225. |
The audit fee
Audit days times a day rate
What moves the certification body’s quote.
A certification body works out how many auditor days your scope needs and prices those days. The rules it must follow for AI management systems are in ISO/IEC 42006:2025, published in July 2025, which adds AI-specific requirements on top of ISO/IEC 17021-1. ISO sells that 31-page standard for CHF 159. Its audit-time rules are not public, so this page does not reproduce them.
Schellman says only that the cost varies with complexity. In practice the quote moves with the number of people and AI systems in scope, your role as a producer, provider, or user of AI, how many sites the auditor must cover, and whether the audit can be combined with one you already have.
Getting comparable quotes
- Find bodies accredited for ISO/IEC 42001 in the ANAB certification body directory (choose the standard first).
- Send each one the same written scope: systems, headcount, sites, and your AI role.
- Ask for audit days per stage, the day rate, travel, and the surveillance and recertification prices.
- Compare days and rates side by side, not only the total.
Sources: ISO/IEC 42006:2025 on iso.org, ANAB ISO/IEC 42001 accreditation program, both read October 19, 2026.
Worked budgets
The arithmetic, shown
Two organizations, two three-year budgets.
Both budgets use only the published figures above. They are examples of how the lines add up, not quotes. Staff time is listed separately because only you know your hourly cost.
Budget A
A 40-person software company that uses third-party AI and already holds ISO/IEC 27001
| Line | Amount |
|---|---|
| The standard (PDF)ANSI Webstore list price | $369 |
| Train one internal lead (self-paced)PECB Lead Auditor eLearning, US price | $589 |
| Readiness checkLow end of Vanta’s range | $3,000 |
| Stage 1 + Stage 2 auditVanta illustrative, 21–50 stakeholders | $7,000 |
| Year 1$369 + $589 + $3,000 + $7,000 | $10,958 |
| Surveillance, years 2 and 3Vanta illustrative, 21–50 stakeholders: $3,500 × 2 | $7,000 |
| Three-year cycle$10,958 + $7,000 | $17,958 |
Plus staff time. Scytale estimates 200 to 400 hours for a 50-person company. No consultant is assumed: the ISO/IEC 27001 system already supplies document control, internal audit, and management review. Ask about an integrated audit (section 06).
Budget B
A mid-size AI vendor that builds its own models and starts with no certified system
| Line | Low | High |
|---|---|---|
| The standard (PDF)ANSI Webstore list price | $369 | $369 |
| Train one internal lead (live course)BSI four-day Lead Auditor, live online | $2,730 | $2,730 |
| Readiness assessmentScytale’s range | $3,000 | $15,000 |
| Implementation helpVanta’s range | $10,000 | $40,000 |
| Stage 1 + Stage 2 auditSchellman’s published band | $20,000 | $40,000 |
| Year 1Sum of the five lines above | $36,099 | $98,099 |
| Surveillance, years 2 and 3Schellman: $13,000 or $20,000 × 2 | $26,000 | $40,000 |
| Three-year cycleYear 1 + surveillance | $62,099 | $138,099 |
Plus staff time. The high column uses $40,000 as the top of Schellman’s “up to the $40,000s” band and $20,000 for “$20,000+” surveillance, so a real quote can land above it. Year 1 low: $369 + $2,730 + $3,000 + $10,000 + $20,000 = $36,099.
Cost drivers
Size your own scope before you ask for a quote
Six questions that decide most of the bill.
Each answer either shrinks the scope an auditor must sample or removes work you would otherwise pay someone to do. Each one links to the Institute document that records the decision.
- 01
Which AI systems, teams, and sites are inside the scope?
Audit time grows with what the auditor has to sample. A scope you can name system by system is cheaper to quote and harder to expand by surprise.
Governance checklist, inventory controls - 02
Are you a producer, a provider, or a user of AI?
ANAB’s ISO/IEC 42001 page notes that the design of the management system depends on the organization’s role. Vanta adds that being a user, producer, or developer of AI changes which Annex A controls apply and how much rigor is expected.
AI governance framework router - 03
Do you already have a written method to tier and assess each system?
ISO/IEC 42001 asks for AI risk assessment and impact assessment. Writing the method during the audit cycle is where consulting hours pile up.
AI risk assessment - 04
Is there a staff policy for AI tools?
Annex A includes policies related to AI. A policy already in force, with training records, is evidence an auditor can read on day one.
AI acceptable use policy - 05
Who has the authority to approve or stop an AI use case?
Leadership and roles are clause 5 of ISO/IEC 42001. An auditor will look for a record of who decided.
Committee charter - 06
Do you already run a certified ISO management system?
An integrated audit with ISO/IEC 27001, 27701, or 9001 can shorten total audit time. The rules are in section 06, below.
Jump to the ISO 27001 section
Already ISO 27001?
What carries over, and what does not
An existing certificate lowers audit time by up to 20%, not to zero.
ISO/IEC 27001 and ISO/IEC 42001 share the same clause 4 to 10 structure, and Schellman notes that ISO/IEC 42001 was designed to fit into an existing security, privacy, or quality program. The audit rules for combining them are in IAF MD 11:2023.
What IAF MD 11 allows
- The certification body first calculates the audit time for each standard separately, then adds them together.
- It may then reduce that total, but by no more than 20%.
- How much it reduces depends on how integrated your documents, internal audits, management reviews, and objectives are, and whether its auditors are qualified for both standards.
- The starting figure and the reason for any reduction must be documented, so you can ask to see them.
What you still have to build
- An AI policy approved by leadership and reviewed at planned intervals (Annex A.2).
- AI risk assessment, risk treatment, and AI system impact assessment (clause 6.1 and Annex A.5).
- A Statement of Applicability for Annex A’s 38 reference controls under nine objectives, A.2 to A.10.
- Records for the AI system life cycle, data for AI systems, and third-party and customer relationships.
Sources: IAF MD 11:2023, Issue 3, clauses 2.1.1 to 2.1.3; Schellman ISO 42001 FAQ; the Annex A objectives as listed by Konfirmity and summarized on the Institute’s AI governance framework page. All read October 19, 2026.
Courses
ISO 42001 lead auditor certification cost
What a course for one person costs.
If the search that brought you here was about your own credential, these are the published prices we found. Prices vary by country, format, and whether the exam is included, so confirm the total at checkout.
| Course | Format | Listed price | What the price covers |
|---|---|---|---|
| ITCERTS ISO/IEC 42001 Professional | Credential application after passing two ITCERTS exams | $100 application fee | The application only. ITCERTS sells the two exams separately.Source: itcerts.ca |
| PECB ISO/IEC 42001 Lead Auditor eLearning (Mindset Cyber, US price) | Self-paced video course, remote-proctored exam | US$589 | Exam voucher, two attempts, certification fee, first year of PECB maintenance.Source: mindsetcyber.com.au |
| BSI ISO/IEC 42001:2023 Lead Auditor (TPECS) | Four days, live online | $2,730 ($2,630 early bird) | BSI course with Exemplar Global-certified competency units.Source: BSI Learning Marketplace |
A credential for one person does not certify the organization they work for. Listing a course here is not a recommendation of any provider.
Timeline
When each cost lands
One certificate, three years, four bills.
- Months before the audit
Define the scope, write the AI policy, run the risk and impact assessments, complete an internal audit and a management review.
Readiness, implementation help, team time - Year 1
Stage 1 reviews documentation and readiness. Stage 2 checks the management system in operation. A certificate follows a successful Stage 2.
Initial audit fee - Years 2 and 3
One surveillance audit each year to confirm the system still runs and still conforms.
Surveillance fee each year - End of year 3
Recertification audit before the three-year certificate expires.
Recertification fee
Schellman describes the two-stage year-one audit, the three-year certificate, and the surveillance reviews in years two and three. Preparation estimates from vendors run from about 4 to 12 months (Cycore) and 6 to 12 months for teams working mostly by hand (Vanta).
Worth the cost?
How AI vendors justify the spend
Pay for the certificate when a buyer will ask for it.
The cost is easiest to justify when customers already ask. Schellman reports that some industries now put ISO 42001 controls into vendor security questionnaires, and that Microsoft is updating its supplier program for vendors that use AI. One certificate can answer the same questions for every customer.
It is harder to justify when nobody is asking. A certificate shows an audited management system. It does not show that a specific AI system meets the EU AI Act, and it does not lower the risk tier of any use case. The Institute’s framework page sets out when certification is worth it and what it will not prove.
Common questions
ISO 42001 cost FAQ
Answers to the questions people search for.
How much does ISO 42001 certification cost?
The certification body’s audit fee is the part you can compare. Schellman publishes a year-one Stage 1 and Stage 2 range from the $20,000s up to the $40,000s, then $13,000 to $20,000+ for each of the two surveillance years. Vanta’s illustrative pricing for very small teams is lower: $5,000 for 1–20 stakeholders and $7,000 for 21–50 in year one. Preparation, training, the standard itself, and your team’s time come on top. The two worked budgets on this page come to $17,958 and $62,099 to $138,099 over a three-year cycle, before staff time.
How much does the ISO 42001 audit alone cost?
Schellman, which describes itself as the first ANAB-accredited ISO/IEC 42001 certification body, says the year-one Stage 1 and Stage 2 audit typically ranges from the $20,000s up to the $40,000s, depending on complexity (FAQ updated June 23, 2026). Fees are built from audit days and the body’s day rate, so get written quotes from two or three accredited bodies for the same scope.
What does ISO 42001 cost each year after certification?
Two surveillance audits, one in year 2 and one in year 3. Schellman publishes $13,000 to $20,000+ for each. Add the cost of keeping the system running: internal audits, management reviews, training refreshers, and any tooling you choose.
Do you pay again for recertification?
Yes. The certificate runs for three years, and a recertification audit starts the next cycle. No certification body we checked publishes a recertification price. Scytale, a compliance software vendor, estimates 60–70% of the initial audit fee. Ask for the recertification price in the original quote.
How much does the ISO/IEC 42001 standard cost?
ISO lists ISO/IEC 42001:2023 at CHF 225. The ANSI Webstore sells the PDF for $369, or $295.20 for ANSI members. Both prices were checked on October 19, 2026. Certification bodies audit against the standard, so someone on the team needs a licensed copy.
How much does an ISO 42001 lead auditor course cost?
That is a course for one person, not certification for your organization. Listings checked on October 19, 2026 run from US$589 for PECB’s self-paced Lead Auditor eLearning with the exam included (Mindset Cyber) to $2,730 for BSI’s four-day live online Lead Auditor course. ITCERTS charges a $100 application fee for its ISO/IEC 42001 Professional credential, with its exams sold separately.
Is ISO 42001 certification mandatory?
No. ISO/IEC 42001 is a voluntary standard. Customers and procurement teams may ask for it, and Schellman reports that some industries now put ISO 42001 requirements into vendor questionnaires. A certificate does not show that any AI system meets the EU AI Act.
How long does ISO 42001 certification take?
Vendor estimates run from about 4 to 12 months (Cycore) and 6 to 12 months for teams working mostly by hand (Vanta). The audit itself has two stages in year one, and the certificate then runs for three years with surveillance audits in years 2 and 3, as Schellman describes.
Does ISO 27001 lower the cost of ISO 42001?
It can lower the audit time. ISO/IEC 27001 and ISO/IEC 42001 share the same clause 4 to 10 structure. Under IAF MD 11:2023, a certification body auditing an integrated system adds the audit time for each standard, then may reduce the total by no more than 20%, depending on how integrated the system is and whether its auditors are qualified for both standards. The AI-specific work, such as impact assessments and the Annex A controls, still has to be done.
How do AI vendors justify ISO 42001 certification costs?
Mostly through sales. Schellman notes that some industries now include ISO 42001 controls in vendor security questionnaires and that Microsoft is updating its supplier program for vendors that use AI. A certificate answers those questions once, for every customer. If no customer or contract asks for it, the Institute’s framework page explains when certification is worth it and what it will not prove.
Does LA Global Institute certify organizations to ISO 42001?
No. LA Global Institute does not certify organizations, systems, or people, and it is not a certification body. Find an accredited certification body in the ANAB directory and confirm every price on this page with the seller before you budget.
Prices were read on the sellers’ own pages on October 19, 2026 and change without notice, so recheck them before you budget. References do not imply affiliation with, or endorsement by, ISO, ANAB, IAF, Schellman, BSI, PECB, ITCERTS, Vanta, Scytale, Cycore, or any other organization.
Lower the bill before the auditor arrives