Cost & timeline estimator
What ISO 42001 certification will cost you, and how long it will take.
US dollars · Benchmarks last reviewed October 9, 2026 · Results update as you answer
Everyone who builds, runs, oversees or governs AI, counted as full-time equivalents. This "AI headcount", not total staff, is what ISO/IEC 42006 uses to size the audit.
- Timeline
- 4–9 mo
- Kickoff to certification decision
- First-year cost
- $11.5k–$42k
- Direct costs
- 3-year cost
- $15.5k–$54k
- Initial + 2 surveillance audits
- Internal effort
- 310–860 hrs
- Your team's time
| Certification audit (Stage 1 + 2)4.9–6.3 auditor-days at typical day rates | $6k–$16k |
|---|---|
| Consulting supportDepends on the support model you pick | $5k–$15k |
| TrainingImplementer or internal auditor courses | $600–$10.5k |
| The standard itselfISO/IEC 42001:2023, CHF 225 from ISO | $200–$300 |
| Surveillance audit, years 2 and 3About a third of the initial audit, each year | $2k–$6.5k/yr |
| Recertification auditDue before month 36; not in the 3-year total | $4k–$12k |
Timeline by phase
- 1Leadership buy-in & scoping2–4 wk
- 2Gap analysis2–4 wk
- 3Build the AIMS foundation3–8 wk
- 4Risk assessment & controls3–6 wk
- 5Implement & document7–15 wk
- 6Internal audit & management review2–4 wk
- 7Certification audit2–4 wk
Low estimateHigh estimate
How the estimate works
Audit fees are auditor-days times a day rate. Auditor-days follow ISO/IEC 42006:2025, which sets a starting audit time by AI headcount and role: AI producers and organizations with multiple roles need more time than providers or users. We then add time for a wide AI system scope (an estimate; 42006 sizes by headcount, role and complexity) and never go below the table value. Surveillance audits in years two and three run at roughly a third of the initial audit; recertification, due before the certificate expires at month 36, runs at about two thirds.
Timelines start from typical greenfield ranges and shorten when an ISO 27001 management system already exists, since its clauses, internal audit and management review carry over. The AI impact assessment and Annex A work stay new effort either way.
Consulting, training and internal effort come from published consultancy and training price lists. These are the least certain inputs: certification bodies and consultancies quote case by case, and no rigorous study of internal effort exists. Treat them as planning ranges, not quotes.
Not included
Travel for on-site audits; certification body application, certificate and report fees; an outsourced annual internal audit; GRC platform subscriptions (often $7,500–$15,000 a year for an ISO 42001 module); tooling for model testing and monitoring; and remediation your gap assessment uncovers. Few bodies are accredited for ISO 42001, so audit slots can take weeks to book. Enterprise (176+) audit-day figures are extrapolated beyond the published 42006 table. Get at least two quotes from accredited certification bodies before budgeting.