ISO 42001 Implementation and Certification Support
Build a certifiable AI management system with a certified ISO/IEC 42001 implementer. Gap assessment first, then a fixed-price plan through to your Stage 2 audit, integrated with your ISO 27001 where you hold it. Fixed quote in 24 hours.
- Certified implementer
- Gap assessment first
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
reference controls in ISO/IEC 42001 Annex A. A certified implementer selects and justifies each one in your Statement of Applicability, mapped to what you already run rather than bolted on.
Buyers Now Ask How You Govern AI. ISO 42001 Is the Certifiable Answer
What the standard is. ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It applies the same harmonised structure as ISO 27001 (context, leadership, planning, support, operation, performance evaluation, improvement) to the AI you develop, provide or use, and adds AI-specific requirements: an AI policy, AI risk assessment, AI system impact assessment and the Annex A reference controls.
Why now. Accredited certification arrived in the UK in January 2026, when UKAS granted BSI the first accreditation to certify AI management systems. UKAS announcement. In the EU, the AI Act’s high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems following the Digital Omnibus. Regulation (EU) 2026/1744. NHS guidance for digital health suppliers describes ISO/IEC 42001 as best practice for AI management systems. NHS Innovation Service guide.
Where we fit. EJN Labs designs and builds the system with a certified ISO/IEC 42001 implementer, and we run ISO 27001 and ISO 9001 management systems ourselves, audited by BSI. We do not issue the certificate. An accredited certification body does, after Stage 1 and Stage 2 audits. We prepare you for both and attend them with you.
Who we help. AI product companies selling into the NHS, public sector and regulated industries, and organisations deploying AI internally that need a defensible governance record. Existing ISO 27001 holders extend their ISMS rather than start again. Where buyers also want the product tested, our AI penetration testing sits alongside the same engagement.
SCOPE OF WORK
What the Engagement Covers
Six workstreams, each mapped to the clauses and Annex A controls it satisfies. Each one scales up or down depending on what you already have in place.
Gap Assessment & Scope
Clause-by-clause review against ISO/IEC 42001 clauses 4 to 10 and the Annex A controls, a draft AIMS scope statement, and a fixed-price implementation plan you can approve before committing to anything else.
AI Policy, Risk & Impact Assessment
AI policy, roles and measurable objectives, then the AI risk assessment, AI system impact assessment and the Statement of Applicability that justifies every control. Where a system processes personal data, built to share evidence with your DPIA.
AI System Life Cycle Controls
Design, development, verification, deployment and monitoring controls for each in-scope AI system, including the security testing evidence buyers increasingly ask for alongside the certificate.
Data Governance for AI
Provenance, quality, preparation and retention records for training and operating data, aligned with your UK GDPR obligations where personal data is involved.
Suppliers, Customers & Third Parties
Controls for the AI you buy in and the AI you sell on: supplier assessments, model provider terms, and the information your customers and users need from you.
Internal Audit, Review & Certification
Internal audit, management review and preparation for the Stage 1 and Stage 2 certification audits. Run jointly with your ISO 27001 cycle where you hold it. We attend the audits and help close any findings.
OUR PROCESS
From Gap Assessment to Certificate
Four phases, with operating evidence built in before the certification body arrives.
Scope & Gap Assessment
We agree which AI systems are in scope, then review you against clauses 4 to 10 and Annex A. You get a gap report and a fixed implementation plan, usually within two weeks of kickoff.
Design the AIMS
AI policy, risk and impact assessment method, Statement of Applicability and the control set, built around how your teams already work. Integrated with your ISO 27001 ISMS where you hold one.
Implement & Operate
Controls go live with the records to prove it: training, supplier reviews, monitoring and incident handling. We run the internal audit and management review with you, so the system has operating evidence before the auditor arrives.
Certification Audit
Stage 1 reviews your documentation, Stage 2 tests the system in operation. We prepare your team, attend both, and help close any findings. Certificates run for three years with annual surveillance audits.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get an ISO 42001 implementation quote in 24 hours
A fixed-price quote back in one business day, from our certified ISO/IEC 42001 implementer. No sales pipeline, no chasing.
- Certified ISO/IEC 42001 implementer. We hold ISO 27001 and ISO 9001 ourselves, audited by BSI.
- Gap assessment before you commit. Clause-by-clause findings and a fixed implementation plan first.
- Working documents in your client portal as we build them, not a PDF at the end.
- Fixed price, agreed after a short scoping call. Certification body audit fees are separate and paid to the body you choose. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from our certified ISO/IEC 42001 implementer.
- You approve the scope and we book the gap assessment, usually within two weeks.
- Gap report, risk register and policy set land in your client portal as we build them, so your team reviews as we go.
Get your fixed ISO 42001 quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from our certified ISO/IEC 42001 implementer.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
One System, Mapped to Every Framework That Asks
Each control is written once and cross-referenced, so your team answers ISO 27001 auditors, AI Act questionnaires and NHS buyers from the same evidence.
ISO/IEC 42001:2023
Clauses 4 to 10 and the 38 Annex A reference controls, with a Statement of Applicability that justifies every inclusion and exclusion.
ISO/IEC 27001
Shared harmonised structure. One risk method, one internal audit programme and one management review across both systems.
EU AI Act
A documented AI management system supports the Article 9 risk management and Article 17 quality management obligations on providers of high-risk AI systems.
UK GDPR & ICO
AI impact assessments and DPIAs built to share evidence, plus governance records for automated decision-making under the Data (Use and Access) Act 2025 changes.
NHS DTAC
NHS guidance names ISO/IEC 42001 as best practice for AI management systems. Pairs with the DTAC technical security evidence our testing already provides.
NIST AI RMF
Govern, Map, Measure and Manage functions cross-referenced to your AIMS controls for customers who ask for a US-framework view.
PRICING
Indicative ISO 42001 Implementation Pricing
Fixed-price quotes confirmed during scoping, with our day-rate disclosure on the pricing page. Certification body audit fees are quoted separately by the body you choose.
Fixed price, depends on scope
Clause-by-clause and Annex A gap report, draft AIMS scope statement and a fixed implementation plan with days per workstream. Remote, with one on-site day where useful.
Get a fixed quoteFixed price, depends on scope
Full AIMS build: AI policy, risk and impact assessment, Statement of Applicability, Annex A controls, internal audit and management review. Organisations with ISO 27001 sit at the lower end.
Get a fixed quoteFixed price, depends on scope
Pre-audit readiness review, Stage 1 and Stage 2 attendance, nonconformity closure and first surveillance preparation. Certification body fees are separate.
Get a fixed quoteWHY EJN LABS
What You Get From ISO 42001 Implementation With EJN Labs
Six concrete differentiators competitors don’t all match.
Certified ISO/IEC 42001 Implementer
Your AI management system is designed and built by a certified ISO/IEC 42001 implementer, not adapted from a generic ISO 27001 template.
We Run ISO Systems Ourselves
EJN Labs holds ISO 27001 and ISO 9001 certification, audited by BSI, plus Cyber Essentials Plus. We know what a Stage 2 auditor asks for because we answer the same questions every year.
Gap Assessment Before You Commit
A clause-by-clause and Annex A gap report with a fixed implementation plan. You decide how much you do in-house and how much we deliver.
Integrated With ISO 27001
Shared harmonised structure means one risk method, one internal audit and one management review. Existing ISO 27001 clients extend their ISMS rather than start again.
Security Evidence, Not Just Paperwork
CREST-accredited testing of the AI product behind the management system where your buyers ask for it. One supplier for the governance and the technical evidence.
Certification Audit Support
We prepare you for Stage 1 and Stage 2 with an accredited certification body, attend both audits, and help close any nonconformities before the certificate is issued.
FAQ
Frequently Asked
What is ISO/IEC 42001?
The international management system standard for artificial intelligence, published in December 2023. It sets out how an organisation governs the AI it develops, provides or uses: policy, roles, risk and impact assessment, life cycle controls, data, suppliers and continual improvement. It is certifiable by an accredited certification body, in the same way as ISO 27001.
Do we need ISO 42001?
No UK law requires it. It is being asked for in procurement, particularly by NHS, public sector and enterprise buyers of AI products, and it gives a recognised structure for EU AI Act obligations where you sell into the EU. If buyers are already asking how you govern AI, it is usually the quickest credible answer.
How long does ISO 42001 implementation take?
Typically three to nine months from gap assessment to certification audit. Organisations that already run ISO 27001 sit at the shorter end, because the management system structure, risk method and audit cycle are shared. The standard needs operating evidence, so plan for at least one internal audit and management review before Stage 2.
Who issues the certificate?
An accredited certification body, not us. UKAS granted BSI the first UK accreditation to certify ISO/IEC 42001 management systems in January 2026, and more bodies are following. We implement the system and support you through the audits. The certification decision is the body’s.
We already hold ISO 27001. How much can we reuse?
A lot. Both standards share the harmonised structure, so your context, leadership, document control, internal audit, management review and corrective action processes extend to the AIMS. The new work is the AI-specific part: AI policy, AI risk and impact assessment, the Annex A controls and the records for each in-scope system.
Does ISO 42001 require a penetration test?
No. ISO 42001 is a management system standard and does not name any technical test. Buyers often ask for one alongside it, and security testing of the AI system is a reasonable verification control under the life cycle requirements. We provide CREST-accredited AI penetration testing where you want it.
How does ISO 42001 relate to the EU AI Act?
Certification is not the same as AI Act compliance. The Act sets legal obligations; the standard gives you a management system to meet many of them in an auditable way, particularly the risk management (Article 9) and quality management (Article 17) duties on providers of high-risk systems. After the 2026 Digital Omnibus, those high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
What is in the gap report?
A clause-by-clause finding against clauses 4 to 10, a control-by-control status for Annex A, the draft AIMS scope, the list of documents and records to create, and a fixed-price implementation plan with days per workstream. You can take the plan in-house or have us deliver it.
Do you sign NDAs?
Yes. We sign client-supplied NDAs as standard. Engagement data is protected under our ISO 27001 (BSI-audited) information security management system.
How quickly can you start?
We reply within one business day with a fixed quote. Gap assessments usually start within two weeks of sign-off, sooner where a tender or audit date requires it.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Start with a gap assessment, not a toolkit
Fixed quote in 24 hours from a certified ISO/IEC 42001 implementer. You see the full gap list before you commit to anything else.
