--- title: "ISO 42001 Explained: The AI Standard You Will Be Asked About | Hypergility" description: "A plain-English guide to ISO 42001 for SMEs: what the AI management standard covers, why enterprise buyers are asking for it, and the certification path." lang: en json-ld: | { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "ISO 42001 Explained: The AI Standard You Will Be Asked About", "description": "A plain-English guide to ISO 42001 for SMEs: what the AI management standard covers, why enterprise buyers are asking for it, and the certification path.", "author": [ { "@type": "Person", "name": "Tuli Faas" } ], "datePublished": "2026-02-24T11:00:00+00:00", "dateModified": "2026-05-21T16:28:51.808646+00:00", "image": "https://aaiqevwzojrlzhxdxxzq.supabase.co/storage/v1/object/public/media-processed/blog-heroes/iso-42001-explained-the-ai-standard-you-will-be-asked-about.jpg", "keywords": "AI Safety, Build & ship", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.hypergility.com/blog/iso-42001-explained-the-ai-standard-you-will-be-asked-about" }, "publisher": { "@type": "Organization", "name": "Hypergility", "url": "https://www.hypergility.com" } } --- [![Hypergility](/assets/hypergility-logo-BKOgRT51.png)for bold startups ](/) Services [Startup Grower](https://startupgrower.hypergility.io/)[Website Build](/build-your-website)[Public Sector Bids](/offerings/win-public-sector-bids)[Management Systems & Assurance](/services/management-systems) Who it's for [Are you a bold founder?](/are-you-a-bold-founder)[Innovation Hubs](/partners/innovation-hubs)[Universities](/partners/universities)[Researchers](/personas/researchers) [Why us](/why-us)[News](/news)[Try Startup Grower](https://startupgrower.hypergility.io/)[Contact](/contact) [Back to News](/news) ![ISO 42001 Explained: The AI Standard You Will Be Asked About](https://aaiqevwzojrlzhxdxxzq.supabase.co/storage/v1/object/public/media-processed/blog-heroes/iso-42001-explained-the-ai-standard-you-will-be-asked-about.jpg) AI Safety Build & ship # ISO 42001 Explained: The AI Standard You Will Be Asked About Tuli Faas February 24, 2026 ISO 42001 is the first international standard for managing AI systems. It was published in December 2023 and adoption has accelerated through 2025 as enterprises started adding it to their vendor security questionnaires. If you sell software with AI in it, the question 'are you ISO 42001 certified or working towards it?' will be on a procurement form within twelve months. ## What ISO 42001 actually covers It is a management system standard — meaning it specifies how you govern AI across its lifecycle, not what your AI must do. If you have seen ISO 27001 (information security) or ISO 9001 (quality), the structure will be familiar: a policy, defined responsibilities, risk assessment, controls, monitoring, internal audit, management review, continuous improvement. - AI policy and objectives signed off by leadership - AI risk assessment methodology and a live risk register - Annex A controls covering data, transparency, human oversight, and lifecycle management - Impact assessments for systems affecting individuals or groups - Supplier and third-party AI management - Incident response and reporting for AI failures ## Why enterprises are asking for it Three pressures are converging. The EU AI Act creates legal exposure for enterprises that deploy non-compliant AI from suppliers. NIST's AI Risk Management Framework is becoming the US baseline. And boards are asking CIOs to evidence AI governance after a string of public AI failures. ISO 42001 is the cleanest single answer to all three: an internationally recognised, independently audited certification. ## The certification path - Stage 0 — gap analysis against the standard (1–2 weeks) - Stage 1 — implementation: write the AI policy, build the risk register, define controls (8–16 weeks for a small team) - Stage 2 — operate the management system for at least 3 months to generate evidence - Stage 3 — Stage 1 audit (documentation review) by an accredited certification body - Stage 4 — Stage 2 audit (operational verification) — pass and you are certified for 3 years - Annual surveillance audits and a full recertification at year 3 ## Cost and effort for an SME **Internal effort.** Expect 0.5–1 FTE for 4 months during implementation, then ~0.2 FTE ongoing. A small product team can do this without hiring a full-time AI risk officer. **External cost.** Audit fees from an accredited body typically run £8k–£20k for an SME, depending on scope. Consultancy support varies wildly — be wary of any quote that does not include a templated risk register and Annex A controls library. **Timeline.** 6–9 months from kick-off to certificate is realistic. Faster is possible if you already hold ISO 27001, because the management system structure overlaps significantly. ## Should you get certified now? Get certified now if you sell into regulated industries, public sector, or any enterprise with a mature procurement function. Start the implementation now even if you do not certify yet — the discipline of writing the policy, doing the risk assessment, and defining human oversight will sharpen your product. Wait if your buyer is consumer or SMB and AI is incidental to your value proposition. Hypergility is ISO 42001 certified — the AI we build into client products is governed to the standard enterprise buyers are starting to demand. We do not sell AI Act compliance as a service. We build AI products to it. If that is what you need, talk to us. [Talk to Hypergility](/contact-us) Hypergility is ISO 42001 certified and helps clients through gap analysis and implementation. If you want to know whether the standard is right for your stage, book a call. [Talk to Hypergility](/contact-us) > “ISO 42001 is going to do for AI what ISO 27001 did for security — make it the table-stakes question on every enterprise RFP.” — Mark Surman , President, Mozilla Foundation By December 2024, 86 organisations worldwide had completed ISO 42001 certification, up from 4 a year earlier — a 21x increase (BSI Annual Review, 2024). Trusted by clients & partners ## Clients and partners we work with [![Sussex Innovation](/trusted-logos/sussex-innovation.png)](https://www.sussexinnovation.co.uk/)[![Aqueous Digital](/trusted-logos/aqueous-digital.png)](https://www.aqueous-digital.co.uk/)[![The Growth Orchard](/trusted-logos/growth-orchard.png)](https://thegrowthorchard.co.uk/)[![GovForms](/trusted-logos/govforms.png)](https://govforms.co.uk/)[![SITA](/trusted-logos/sita.png)](https://www.sita.aero/)[![University of Sussex](/trusted-logos/university-of-sussex.png)](https://www.sussex.ac.uk/) As seen at ## Where we show up in the community [![BrightonAI Show and Tell](/trusted-logos/brightonai.png)](https://brightonai.org) Certifications ## Standards we are independently certified against [ ![ISO 9001 Badge](/assets/iso-9001-DeXtyob9.svg) ISO 9001 Quality Management ](/we-are-iso-9001-company-certified)[ ![ISO 27001 Badge](/assets/iso-27001-BiHzm-R-.svg) ISO 27001 Information Security ](/we-are-iso-27001-company-certified)[ ![ISO 42001 Badge](/assets/iso-42001-WNouqNfX.svg) ISO 42001 AI Management System ](/we-are-iso-42001-company-certified)[ Cyber Essentials UK Cyber Security ](/we-are-cyber-essentials-certified)[ Cyber Essentials Plus Independently verified ](/we-are-cyber-essentials-plus-certified) [![Hypergility](/assets/hypergility-logo-BKOgRT51.png)](/) People and our AI companion — challenging you, not just agreeing Making ideas investable For founders — we help you shape it, set it up, build it and monetise it. [Try Grower](https://startupgrower.hypergility.io/)[](https://www.linkedin.com/company/hypergility) #### Starting out Lane overviews - [Starting out](/starting-out) - [Are you a bold founder?](/are-you-a-bold-founder) - [The Startup In You](/the-startup-in-you) - [Resources in play](/resources-in-play) Stepping up - [Overview](/stepping-up) - [Researchers](/personas/researchers) - [Sales rainmakers](/personas/sales-rainmakers) - [Tech wizards](/personas/tech-wizards) - [Domain experts](/personas/domain-experts) - [Creative designers](/personas/creative-designers) - [Voluntary redundancy](/personas/voluntary-redundancy) - [Retiring, not done](/personas/retiring-not-done) No job, need a path - [Overview](/no-job-need-a-path) - [Made redundant](/personas/made-redundant) - [End of contract](/personas/end-of-contract) - [Mutually parted ways](/personas/mutually-parted-ways) - [Resigned](/personas/resigned) - [Pushed out, can't get back](/personas/pushed-out-cant-get-back) - [Overqualified / age barriers](/personas/overqualified-age-barriers) - [Returning after a break](/personas/returning-after-break) - [Retired, need income](/personas/retired-need-income) - [Never employed](/personas/never-employed) - [Grads, no offers](/personas/grads-no-offers) Fitting it in - [Overview](/fitting-it-in) - [Students / college](/personas/students) - [Side hustlers](/personas/side-hustlers) - [Work returners](/personas/work-returners) - [Career changers](/personas/career-changers) - [Family duties](/personas/family-duties) - [Health / disability barriers](/personas/health-disability-barriers) - [Post-prison](/personas/post-prison) - [Underrepresented founders](/personas/underrepresented-founders) #### Resources in play Lane overviews - [Resources](/resources) - [Roadmap](/roadmap) - [News & insights](/news) Short runway - [Overview](/short-runway) - [Cash crunch](/personas/cash-crunch) - [Turnaround / restructure](/personas/turnaround) - [Distressed](/personas/distressed) - [Preserve, or pivot](/personas/preserve-or-pivot) Resourced and reloading - [Overview](/resourced-and-reloading) - [Successful exiters](/personas/successful-exiters) - [Go-again success seekers](/personas/go-again) - [Post-raise reset](/personas/post-raise-reset) - [Pre-series A](/personas/pre-series-a) - [Grant-funded R&D](/personas/grant-funded-rd) - [Money inheritors](/personas/money-inheritors) Struggling with investors - [Overview](/struggling-with-investors) - [Pitch isn't landing](/personas/pitch-not-landing) - [Wrong room, wrong investors](/personas/wrong-room) - [Term-sheet stalled](/personas/term-sheet-stalled) - [Bridge or down-round](/personas/bridge-or-down-round) - [Post-rejection reset](/personas/post-rejection-reset) #### Startup Grower - [Grower overview](/grower) - [Validate](https://idea.hypergility.io/) - [Pitch](/grower/pitch) - [First customer](/grower/first-customer) - [Brand site](/grower/brand-site) - [Open Grower app](https://startupgrower.hypergility.io/) - [Website Build](/build-your-website) - [Public Sector BidsLater ](/offerings/win-public-sector-bids) - [All offerings](/pricing) - [Pricing](/pricing) - [Roadmap](/roadmap) #### Capabilities - [AI safety](/ai-safety) - [R&D claims](/rnd-claims) - [Smarter IP](/smarter-ip) - [Trust & certifications](/trust) #### Company - [Privacy](/privacy-policy) - [Cookies](/cookie-policy) - [Terms](/terms-of-use) - [Use policy](/use-policy) - [ICO registration](/ico-registration) - [AI ethics](/ai-ethics) - [IP statement](/ip-statement) - [Image attribution](/image-attribution) #### Company - [Home](/) - [What we do](/what-we-do) - [Why us](/why-us) - [Contact](/contact) - [News](/news) - [Roadmap](/roadmap) - [Sitemap](/sitemap) - [llms.txt](/llms.txt) - [Trust & certifications](/trust) #### How we work [ Do it yourself Self-serve with Grower ](/do-it-yourself)[ Do it with you Coaching & expert sprints ](/do-it-with-you)[ Do it for you Done-for-you delivery ](/do-it-for-you)[ Do it with a partner Vetted specialist network ](/do-it-with-a-partner) #### Offerings Tap any card for the dedicated page. Status shown on each. Launch sequence — earliest to latest Live shipping today — buy or book now › Next in build, launching soon › Later scheduled, design stage › On radar validated demand, no date yet [Shape](/shape) Pressure-test the idea - [Is my idea any good?Live ](/offerings/is-my-idea-any-good) - [Bootstrap your runwayLive ](/offerings/bootstrap-your-runway) - [Validate fastLive ](/offerings/validate-fast) - [Size the prizeNext ](/offerings/size-the-prize) - [Competitor intelligenceNext ](/offerings/competitor-intelligence) - [Nail the pitchLive ](/offerings/nail-the-pitch) [Set-up](/set-up) Get the foundations right - [Incorporate & structureLive ](/offerings/incorporate-and-structure) - [Cap table & equityNext ](/offerings/cap-table-and-equity) - [Tax-efficient share schemesOn radar ](/offerings/tax-efficient-share-schemes) - [Claim R&D creditsLive ](/offerings/claim-randd-credits) - [SEIS/EIS advance assuranceLater ](/offerings/seis-eis-advance-assurance) - [Signal EquityNext ](/offerings/signal-equity) [Build](/build) Ship what customers want - [Ship the productLater ](/offerings/ship-the-product) - [Get found onlineNext ](/offerings/get-found-online) - [Win grants & innovation loansLater ](/offerings/win-grants-and-innovation-loans) [Monetise](/monetise) Turn traction into revenue - [Win first customersNext ](/offerings/win-first-customers) - [Pricing & business modelNext ](/offerings/pricing-and-business-model) - [Buyer-ready sales decksNext ](/offerings/buyer-ready-sales-decks) - [Activate IP for partnershipsLive ](/offerings/activate-ip-for-partnerships) - [Win public sector bidsLater ](/offerings/win-public-sector-bids) - [C-suite distribution networkOn radar ](/offerings/c-suite-distribution-network) #### Partner network Advisors & Professionals - [Accountants & advisors](/partners/accountants) - [Lawyers & legal advisors](/partners/lawyers) - [Agencies & consultants](/partners/agencies-and-consultants) - [Independent consultants](/for-consultants) Capital & Community - [Investors, angels & syndicates](/partners/investors) - [Founder communities & networks](/partners/communities) - [Trade associations](/partners/trade-associations) Innovation & Education - [Universities & TTOs](/partners/universities) - [Innovation hubs & incubators](/partners/innovation-hubs) - [Accelerators](/partners/accelerators) - [Tech & integration partners](/partners/tech-and-integration-partners) Workforce Transitions - [Outplacement agencies](/for-outplacement-agencies) - [HR & redundancy teams](/for-employers-redundancy) #### Registered Hypergility Hypergility Ltd & Hypergility Innovations Ltd [help@hypergility.com](mailto:help@hypergility.com) Trading address Science Park Square Brighton BN1 9SB Registered office 66 Paul Street London England EC2A 4NA #### Independently certified [![ISO 9001](/assets/iso-9001-DeXtyob9.svg)ISO 9001 ](/we-are-iso-9001-company-certified "ISO 9001")[![ISO 27001](/assets/iso-27001-BiHzm-R-.svg)ISO 27001 ](/we-are-iso-27001-company-certified "ISO 27001")[![ISO 42001](/assets/iso-42001-WNouqNfX.svg)ISO 42001 ](/we-are-iso-42001-company-certified "ISO 42001")[CE Cyber Essentials ](/we-are-cyber-essentials-certified "Cyber Essentials")[CE+ Cyber Essentials Plus ](/we-are-cyber-essentials-plus-certified "Cyber Essentials Plus") © 2016 - 2026 Hypergility Ltd. All rights reserved. © 2024 - 2026 Hypergility Innovations Ltd. All rights reserved. We use cookies to improve your experience and analyse site traffic. You can manage your preferences or read our [Privacy Policy](/privacy-policy). Accept AllReject Non-EssentialManage Preferences