Direct answer: ISO 42001 cost and timeline vary with organisation size, number and complexity of AI systems, existing ISO 27001 maturity, evidence starting point and internal resourcing. A responsible estimate follows an initial assessment; it should not be presented as a universal price or deadline.
ProtectifyAI uses outcome-based positioning: a fixed fee is agreed after assessing your starting point and scope. Certification-body fees remain separate, and certification readiness is not the same as the independent certification audit.
Organisation size and scope
A focused scope covering one product and its supporting processes generally requires less coordination than a multi-product organisation with several legal entities, locations or business units. Size affects interviews, governance forums, training, evidence sampling and the number of control owners—not simply the number of employees.
Number and complexity of AI systems
Each system may have different intended uses, suppliers, data flows, risk and impact considerations, human oversight and monitoring. A small inventory of well-understood systems can be easier to assess than a larger estate of embedded features, experiments and third-party models that changes frequently.
Existing ISO 27001 maturity
An operating ISMS can provide reusable document control, leadership review, risk treatment, supplier oversight, internal audit and corrective-action processes. It does not remove AI-specific work: the AIMS still needs an AI inventory, AI risk and impact assessment, model and data evidence, human oversight and lifecycle controls. See ISO 27001 implementation and our ISO 42001 and EU AI Act guide.
Internal resourcing and evidence
Progress depends on timely access to product, engineering, security, privacy and leadership owners. Teams that already retain evaluation results, approvals, monitoring records, supplier reviews and incident evidence can focus on mapping and closing gaps. Where evidence is informal or absent, implementation includes designing workflows and allowing them to operate long enough to demonstrate effectiveness.
Typical work sequence
- Assessment: confirm scope, inventory, roles, risk method, Annex A coverage and evidence gaps.
- Design: approve policy, objectives, risk and impact methods, ownership and documentation structure.
- Implementation: operate controls across AI lifecycle, suppliers, evaluation, oversight, monitoring and incidents.
- Readiness: complete internal audit, management review and corrective actions before engaging the certification body.
- Certification: coordinate Stage 1 and Stage 2 with the independent certification body and respond to findings.
The schedule should be agreed around your scope and starting point. Expanding scope, changing models, delayed decisions, limited internal capacity and certification-body availability can extend the work; a stable scope and mature evidence can reduce rework.
FAQ
Cost varies with organisation size, AI system scope, existing management-system maturity and internal resourcing. A fixed fee can be agreed after an assessment of the starting point and required work.
The timeline is driven by scope, number and complexity of AI systems, evidence maturity, internal availability, remediation effort and certification-body scheduling.
An operating ISMS can provide reusable processes for leadership review, documented information, risk, suppliers, audit and corrective action, but AI-specific governance and evidence still need to be addressed.
Plan from your actual starting point
Discuss scope, maturity and resourcing before committing to a certification plan.
Explore ISO 42001 consultancy →