ISO 42001: What UK SMEs Need to Know Before Pursuing Certification

ISO 42001 follows the Annex SL high-level structure used by ISO 9001, ISO 14001, and ISO 27001. If your organisation already holds any of those certifications, the management system architecture will be familiar.

The standard covers: organisational context and stakeholder requirements, leadership commitment and AI policy, planning including risk and opportunity assessment, support including resources and competence, operational controls for AI system development and deployment, performance evaluation, and continual improvement.

The distinctive element of ISO 42001 compared to other management system standards is its treatment of AI-specific risks: bias, opacity, safety, and the obligations that arise when AI systems affect people. The standard requires organisations to consider these risks systematically and to document their controls.

Certification is not legally required for any UK organisation at present. The EU AI Act does not mandate ISO 42001 certification, though it does require documented risk management and governance controls that ISO 42001 alignment satisfies.

Where certification is becoming a de facto requirement is in procurement. Several UK public sector frameworks, including NHS supply chain and some central government frameworks, are beginning to ask for evidence of AI governance capability. ISO 42001 certification is the cleanest way to provide that evidence.

For most UK SMEs, the practical answer is: ISO 42001 alignment over certification. Build a management system that would pass an ISO 42001 audit, document it properly, and be ready to certify if a commercial relationship requires it. That position is defensible, cost-effective, and delivers the governance benefits without the certification timeline and cost.

For a UK SME starting from scratch, building an ISO 42001-aligned AI management system typically involves the following.

ISO 42001 certification requires an accredited certification body. In the UK, UKAS-accredited bodies including BSI and Bureau Veritas are offering ISO 42001 audits. The audit itself typically costs £3,000 to £8,000 for an SME depending on scope and the certification body. Annual surveillance audits add a further £1,500 to £3,000 per year.

The larger cost is the preparation. Building a compliant management system, closing the gaps identified in a pre-assessment, and producing the documentation required for audit typically costs more than the audit itself. Budget a total of £15,000 to £30,000 for a UK SME to achieve initial certification from a standing start, including specialist support.

Start with a gap analysis. A structured review of your current AI governance position against the ISO 42001 requirements tells you how far you are from compliance and which gaps are largest. That review typically takes one day and costs £1,750. The output is a prioritised action list and a realistic timeline to certification or alignment.

Book a gap analysis to understand your current position and the most cost-effective path to ISO 42001 alignment or certification.