ISO42k
On this page

For buyers

How to check an ISO 42001 certificate

Three checks, about ten minutes, and the registers to do them on.

Why check

"ISO 42001 certified" is now a line in a lot of security questionnaires and press releases. Most of those claims are sound. But a certificate is only worth what the body behind it is worth, and a press release often names no body at all. When we went through the announcements cited in our own directory, more than a third did not name the certifier, and a handful named the wrong one.

Accreditation is what makes a certificate mean something. An accreditation body, usually a national one, checks that a certification body is competent and impartial for a specific standard. A body accredited for ISO 27001 is not thereby accredited for ISO 42001.

The three checks

  1. 1. Get the certificate, not the announcement

    Ask for the certificate itself, or find it on the vendor's trust center. You need four things from it: the certification body's name, the certificate number, the scope, and the expiry date. A vendor that will not share the certificate is an answer in itself.

  2. 2. Check the body is accredited for ISO 42001

    Look the certification body up on the register of the accreditation body it names, and confirm ISO/IEC 42001 is in its scope. The registers are listed below. Our certifier profiles carry the accreditation number where we have checked one.

  3. 3. Confirm the certificate with the body that issued it

    Most certification bodies run a certificate lookup by number, or will confirm by email. This is the step that catches a lapsed or suspended certificate, and it is the only check that confirms the vendor actually holds it. Then read the scope: it says which products, sites and AI roles the certificate covers, and it is often narrower than the marketing.

Where to look

Every national register we know of that lists ISO 42001 accreditations, with how to search it. The count is the number of our certifier profiles accredited through that register.

RegisterCountryHow to searchBodies
ANAB
ANSI National Accreditation Board
USFilter the directory by standard: ISO/IEC 42001.19
IAS
International Accreditation Service
USSearch management system certificates for "artificial intelligence".18
UAF
United Accreditation Foundation
USLook up the body, then open its scope document for AIMS.7
UKAS
United Kingdom Accreditation Service
UKBrowse the AI management systems category.5
RvA
Raad voor Accreditatie
NetherlandsSearch 42001 and open the Scopes tab.3
JAS-ANZ
Joint Accreditation System of Australia and New Zealand
Australia / NZFilter by the Artificial Intelligence Management System Scheme.6
NABCB
National Accreditation Board for Certification Bodies
IndiaOpen the AIMS tab.4
SCC
Standards Council of Canada
CanadaThe link opens the AI management system filter.3
KAB
Korea Accreditation Board
South KoreaSearch by standard: 42001.11
ISMS-AC
Information Management System Promotion Center
JapanThe list of accredited AIMS certification bodies.2
SAC
Singapore Accreditation Council
SingaporeAdvanced search, field: Artificial Intelligence Management System.1

Some registers only work in a browser, and SAC asks you to pass a captcha. Germany (DAkkS), France (COFRAC) and Spain (ENAC) listed no body accredited for ISO 42001 when we checked, and China (CNAS) had not yet opened a scheme for it.

Red flags

  • The accreditation body named on the certificate does not list the certification body for ISO 42001, only for other standards.
  • The certificate cites an accreditation from a country whose register has no ISO 42001 scheme.
  • The only evidence is a listing on IAF CertSearch. It records certificates that bodies upload; it is not an accreditation register.
  • The scope covers one product or site, and the vendor talks about the whole company.
  • The certificate has expired, or the body cannot find it by number.
  • The vendor describes itself as "ISO 42001 compliant" or "aligned". That can be true and useful, but it is not certification.

Where to next