ISO 42001 certification: show you use AI responsibly
ISO 42001 certification shows that your organisation uses or builds artificial intelligence (AI) with clear rules: approved tools, known risks, human oversight and care for personal data. Certification suits firms using AI with customer data, and firms selling AI products. We implement; an accredited certification body audits and issues the certificate.
Who asks for it, and what it shows them
One certificate. Many audiences read it.
- Board and shareholders“Is our use of AI governed, or are we exposed?”A management system for AI risks, built on Plan-Do-Check-Act.ISO, read 12 Oct 2026
- Customers“Can I trust how your AI uses my data and makes decisions?”ISO lists responsible use, traceability, transparency and reliability as outcomes.ISO, read 12 Oct 2026
- Regulators“Are you aligned with the AI standards Singapore is backing?”Singapore runs a national adoption and accreditation programme for ISO/IEC 42001.IMDA, read 12 Oct 2026
- Partners and multinational clients“(A multinational client) Your service uses AI. What assurance do you have?”Microsoft accepts ISO 42001 to validate its AI supplier requirements.Microsoft, read 12 Oct 2026
- Competitors“Who certifies this, and is it credible here?”Since February 2025, certification bodies can be accredited in Singapore for ISO/IEC 42001.SAC, read 12 Oct 2026
Microsoft suppliers whose services involve AI must submit ISO 42001 or complete an independent assessment before new in-scope purchase orders are processed.
Microsoft, read 12 Oct 2026Who it is for
Firms that build AI products, use AI on customer or patient data, or face client questions about AI. Technology and risk leads get an AI management system (AIMS) with impact assessments and controls.
Who does what
- You
You name a project lead, list your AI uses and run the agreed rules.
- Us: we prepare you
We implement: AI inventory, risk and impact assessments, policy, controls, internal audit and management review.
- Independent body: audits and certifies
An accredited certification body audits your AI management system and, if you conform, issues the certificate.
What you get
Deliverables mapped to what the assessor tests.
- An inventory of the AI systems you build, sell or use
- AI risk and impact assessments
- Policies and controls mapped to the ISO/IEC 42001 clauses
- Internal audit and management review records
What drives the time and the effort
- How many AI tools and models you use or build
- Whether AI touches personal, patient or financial data
- Existing ISO/IEC 27001 or privacy controls you can reuse
- How many teams and vendors are involved
- The certification body’s audit fee, charged by that body
Our ISO implementers practise as lead auditors for ISO/IEC 42001, 27001, 27701 and 22301.
Common questions
What is ISO 42001 all about?
ISO/IEC 42001 is the international standard for an AI management system, published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The standard covers how you approve, assess, monitor and improve your use of AI.
Is ISO 42001 mandatory?
No. ISO 42001 is voluntary. Certification gives clients and tender panels an independent answer to how you govern AI.
Is there any regulation on AI in Singapore?
Yes, in part. The Personal Data Protection Act (PDPA) applies whenever AI uses personal data, and sector regulators publish their own AI guidance. ISO 42001 gives you one system to manage both.
How much does ISO 42001 certification cost?
Our fee depends on how many AI uses, teams and vendors are in scope; the certification body charges its own audit fee. You get a fixed-fee proposal after a short scoping call. Government grants may cover part of the cost. We check at your first call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Latest PDPC case on this topic · 2026-09-21 · Food and beverage · Voluntary undertaking
A script written with a personal AI tool exposed members' email addresses to each other; review and test any code that handles personal data before live use.
Read the PDPC decision of 21 September 2026, on pdpc.gov.sg (opens in a new tab)ISO work is led by a practising lead auditor, certified through IRCA or PECB.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)