ISO 42001 explained for a UK SME: what it is, what it costs, and whether you need it.

ISO/IEC 42001, published in December 2023, specifies the requirements for establishing, implementing, maintaining and continually improving an AI management system. Like the other management-system standards it follows the plan, do, check, act structure: context and scope, leadership and policy, risk assessment and treatment, resources and competence, operational controls, performance evaluation and improvement. Its Annex A lists the controls an organisation selects from, covering AI policies and roles, impact assessment, the AI system lifecycle, data for AI systems, information for interested parties, use of AI systems and third-party relationships. The point of the structure is that AI use is governed as a system, with owners and evidence, rather than as a collection of individual decisions.

Certification runs as a Stage 1 and Stage 2 audit by an accredited body, is valid for three years, and carries annual surveillance audits. UKAS announced in January 2026 that it had granted BSI the first UK accreditation for certification to ISO/IEC 42001, which is the point at which a UK certificate became one a client’s procurement team can rely on. Published UK cost estimates for a small firm range from about £8,000 for the simplest cases to a more typical £20,000 to £60,000 including consultancy, internal work and audit fees, over four to nine months, with the lower end available to firms that already hold ISO 27001 and can extend their existing system.

Ranges from UK certification bodies’ and consultancies’ published estimates in 2026; get a quote from an accredited body for your own scope.

Three kinds of firm. Vendors selling AI-enabled products to large or regulated customers, where the certificate answers a procurement question in one line, as it does for Anthropic, which lists ISO 42001 alongside ISO 27001 and SOC 2. Firms in regulated sectors whose regulator or insurer has started to ask for it. And firms bidding for public-sector or enterprise contracts where it appears in the tender. For most UK SMEs using AI to run their own operations, it is a large cost to answer a question nobody has asked, and the useful move is to adopt the controls a questionnaire will ask about without the audit.

The parts of 42001 a client questionnaire asks about can be in place in a month. A written AI policy with roles. A register of the AI systems the firm uses and builds, with the risk of each assessed and a named owner. An impact assessment for anything that affects individuals, which for a UK firm is the DPIA. Data governance for AI: what goes in, where it is processed, retention. A supplier record with the DPA and attestations for each provider. Monitoring: an acceptance threshold, cost ceilings, outcome checks. And a review cycle. That is the substance of the standard at a cost of a few days’ work, and it is a straightforward step up to certification later if a client requires it.

When a client, a tender or a regulator asks for it in writing, and not before. At that point a firm that has run the SME version has most of the evidence, and the work is documenting it to the standard’s structure and buying the audit. Firms that hold ISO 27001 should extend it rather than start again. Either way, get a quote from a UKAS-accredited body for your actual scope, because the published ranges are wide and the scope decides where in them you land.