Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How do you choose an ISO 42001 certification body?
Last verifiedChoose an ISO 42001 CB by verifying accreditation on IAF CertSearch or a national AB register, then evaluating scope, geography, and audit team competence. Not a ranking. Not legal advice.
CB selection guide, last verified 10 September 2026 against ISO/IEC 17021-1 and IAF materials. Never rank bodies without defensible criteria. UNKNOWN if unverified. Not legal advice.
Verify accreditation first
- Open IAF CertSearch or YOUR national AB (UKAS, ANAB, DAkkS, A2LA, etc.).
- Match legal entity name, standard ISO/IEC 42001, and accredited scope to YOUR sites.
- If no register entry — treat as UNKNOWN; do not rely on marketing certificates.
- IAF MLA signatory status supports international recognition of the AB chain.
Evaluation criteria
| Criterion | What to verify | Red flag |
|---|---|---|
| Accreditation | AB-listed for ISO/IEC 42001 at YOUR sites | No register entry |
| Scope | Certificate scope covers YOUR AI systems and locations | Generic 'all services' marketing |
| Audit team | Lead auditor competence in AI/AIMS | Refuses CVs or credentials |
| Independence | No same-firm consulting on same scope | One team writes and audits |
| Cycle terms | Stage 1/2, surveillance, recertification dates clear | Vague 'lifetime' certificate claims |
| Fees | Written proposal against YOUR scope | Up-front certificate without audit |
Red flags — unaccredited certificates
- Certificate PDF with no AB logo or register link.
- Body not found on IAF CertSearch or national AB site.
- Guaranteed pass or certificate before audit.
- Rankings or 'top CB' lists without stated criteria — this page is not one.
What to do now
- Shortlist three AB-verified CBs — compare proposals, not blog rankings.
- Read certification-process page for Stage 1/2 expectations.
- Use best ISO 27001 certification bodies page methodology for register discipline — different standard, same verification habit.
Checklist
- ☐ Register screenshot saved with date?
- ☐ Scope statement matches YOUR AIMS boundary?
- ☐ Independence confirmed in contract?
- ☐ Surveillance calendar agreed?
Where this shows up in ShipReady Metrics
ShipReadyMetrics does not recommend, rank, or contract with certification bodies. Evidence preparation is YOUR responsibility; CB selection is YOUR procurement decision.