They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
38 ANNEX A CONTROLS ACROSS 9 OBJECTIVES
ISO 42001:2023 Certification Services
Build Responsible AI with ISO 42001
The world's first AI governance standard. Get EU AI Act ready and demonstrate responsible AI practices with ISO 42001:2023 certification.
- Early-mover expertise in ISO 42001 and AI governance
- EU AI Act aligned governance framework
- Complete coverage of 38 AI management controls
Early Mover in AI Governance · 38 AI Controls · Serving India, USA, UK, Australia & EU
1,000+Audits DeliveredTo date
300+SOC 2 EngagementsTo date
8–12wkTime to CertificationAverage timeline
38Annex A Controls9 control objectives
Overview
What is ISO 42001?
ISO/IEC 42001 is the world's first international standard for Artificial Intelligence Management Systems (AIMS). Published by ISO in December 2023, it provides a certifiable framework for responsible AI development, deployment and use, built on the same Annex SL backbone as ISO 27001.
Its Annex A defines 38 controls across 9 control objectives (A.2–A.10) — spanning AI policy, internal organisation, resources, AI impact assessment, the AI system life cycle, data for AI, and third-party use. Certification demonstrates documented, auditable maturity in AI governance and risk management.
- First AI management system standard, globally recognised (ISO/IEC 42001:2023)
- Maps to EU AI Act obligations for high-risk AI systems
Key Takeaways
- ISO/IEC 42001:2023 is the world’s first certifiable AI management system (AIMS) standard, published by ISO in December 2023 (Source: ISO/IEC 42001).
- Annex A specifies 38 controls across 9 control objectives (A.2–A.10), from AI policy and impact assessment to AI lifecycle and third-party use.
- It shares the Annex SL backbone of ISO 27001, integrates with an existing ISMS, and maps onto EU AI Act obligations for high-risk AI systems.
- Tranquility — an early mover in ISO 42001 consulting — delivers AIMS certification in 8–12 weeks. Engagement pricing is scoped to your AI footprint (request a quote via our contact page).
Benefits
ISO 42001 Delivers Business Value
ISO 42001 certification demonstrates responsible AI governance, reduces regulatory risk, and enables enterprise sales in regulated markets.
AI Governance Framework
Demonstrate responsible AI governance to investors, customers, and regulators with certified processes.
EU AI Act Readiness
Prepare for EU AI Act compliance before enforcement. ISO 42001 aligns with AI Act requirements.
Competitive Advantage
First-mover advantage in regulated AI markets. Win enterprise deals requiring AI governance proof.
Key Features
AI Management System Framework
ISO 42001 covers all critical aspects of responsible AI management and governance.
AI Governance
Establish clear AI policies, accountability structures, and oversight mechanisms for all AI systems.
Risk Management
Identify, assess, and mitigate AI-specific risks including bias, hallucinations, and security vulnerabilities.
Ethical AI Practices
Ensure responsible, fair, and transparent AI development and deployment across your organization.
Continuous Monitoring
Implement ongoing AI performance monitoring, model drift detection, and governance reviews.
TIME-SENSITIVE
Urgency
Why Get Certified Now?
The AI regulation wave is coming. Early movers gain competitive advantage.
EU AI Act Enforcement
HIGHThe EU AI Act comes into full effect in 2025-2026. Companies serving European customers need AI governance frameworks NOW to avoid penalties and market restrictions.
Enterprise Requirements
HIGHFortune 500 companies are adding AI governance to vendor security questionnaires. Without certification, you lose enterprise deals before the sales cycle starts.
AI Liability Exposure
MEDIUMAI failures, algorithmic bias, and hallucinations create legal liability. ISO 42001 certification demonstrates due diligence and risk mitigation.
Investor Confidence
MEDIUMVCs and institutional investors increasingly require responsible AI practices. Certification signals organizational maturity and reduces investment risk.
Who Needs This
Who Needs ISO 42001?
If you build, deploy, or use AI systems, this certification is for you.
AI/ML Product Companies
Building AI-powered products, LLM applications, or ML platforms
AI SaaS, MLOps, AI Agents, Chatbots, GenAI Tools
AI-Enabled Enterprises
Using AI in business-critical operations or customer-facing applications
Fintech, Healthtech, Legaltech, HRtech
EU Market Entrants
Companies expanding to or selling in the European market
SaaS with EU customers, B2B exports to Europe
AI Service Providers
Consulting firms, system integrators, or managed AI services
AI consulting, model training, AI operations
The Standard
The 9 Annex A Control Themes
ISO/IEC 42001:2023 organises its 38 Annex A controls into nine control objectives (A.2–A.10). Together they define what an AI management system must govern, end to end.
| Ref | Control Theme | What It Governs |
|---|---|---|
| A.2 | AI Policies | Documented AI policy aligned to business objectives, set and reviewed by leadership. |
| A.3 | Internal Organisation | Roles, responsibilities and accountability for AI, including reporting of concerns. |
| A.4 | Resources for AI Systems | Data, tooling, compute, human and system resources needed to run AI responsibly. |
| A.5 | AI Impact Assessment | Assessing consequences of AI systems for individuals, groups and society. |
| A.6 | AI System Life Cycle | Responsible design, development, verification, deployment and decommissioning. |
| A.7 | Data for AI Systems | Governance of training, testing and operational data — quality, provenance, bias. |
| A.8 | Information for Interested Parties | Transparency and documentation provided to users, regulators and affected parties. |
| A.9 | Use of AI Systems | Responsible, intended-purpose use and human oversight in operation. |
| A.10 | Third-Party & Supplier Relationships | Managing risks from foundation models, vendors and external AI components. |
Control objectives and structure per ISO/IEC 42001:2023, Annex A. Each organisation justifies applicable controls in its AIMS Statement of Applicability.
From the Audit Team
What Our Lead Auditors Tell Clients
Practical guidance from the people who run the AIMS certification — not theory.
“The AI system inventory is where ISO 42001 audits are won or lost. If you cannot list every model in production with its intended purpose and risk classification, you cannot run the Annex A.5 impact assessment — and everything downstream stalls. We start every engagement by building that register, foundation models and shadow AI included.”
“Teams over-engineer the documentation and under-invest in human oversight. The control an auditor probes hardest is whether a person can actually intervene when a model behaves unexpectedly — and whether that intervention is logged. Demonstrable oversight beats a hundred pages of policy every time.”
“Got our ISO 42001 Certification done with Tranquility, Smooth Experience.”
What's Included
Comprehensive ISO 42001 Certification Services
End-to-end support from AI system inventory through successful certification and ongoing AIMS maintenance.
AI System Inventory
Comprehensive mapping of all AI systems, purposes, data sources, and risk classifications.
AIMS Documentation
Develop complete AI Management System documentation including policies, procedures, and governance framework.
Risk Assessment
Structured AI risk identification, analysis, and treatment covering bias, explainability, security, and privacy.
Control Implementation
Deploy AI governance controls, monitoring mechanisms, and automated compliance checking.
Internal Audit
Conduct complete internal AIMS audit before certification body assessment.
Certification Support
Coordinate with accredited certification bodies and manage all auditor interactions.
Your Path to ISO 42001
Certification Timeline
Here is how a typical engagement runs, week by week. Your scope sets the actual pace.
Weeks 1-2
AI System Inventory & Scoping
Map all AI systems, their purposes, data sources, risk levels, and define AIMS scope.
Weeks 2-4
AI Risk Assessment
Evaluate AI-specific risks: bias, explainability, security, privacy, and ethical concerns.
Weeks 4-8
Controls Implementation
Implement AI governance policies, monitoring mechanisms, and control frameworks.
Weeks 8-10
Documentation & Training
Complete AIMS documentation, AI use case register, and conduct organization-wide training.
Weeks 10-11
Internal Audit
Perform internal AIMS audit, management review, and remediate identified gaps.
Weeks 11-12
Certification Audit
Stage 1 (document review) and Stage 2 (on-site audit) by accredited certification body.
Why Choose Us
Your Trusted AI Governance Partner
Choose Tranquility for early-mover expertise in ISO 42001 and AI governance. We were among the first consulting teams to master this emerging standard.
Early Mover Expertise
Early movers in ISO 42001 consulting with deep AI governance and compliance expertise.
EU AI Act Alignment
Our ISO 42001 implementation ensures readiness for EU AI Act compliance requirements.
8–12 Week Timeline
Streamlined implementation roadmap from AI system inventory to certification.
Learning Resources
Explore Our ISO 42001 Hub
Comprehensive guides, templates, and resources to support your AI governance journey.
Governance Guide
AI Governance Framework
Complete guide to establishing AI governance structures, policies, and accountability mechanisms.
Risk Management
AI Risk Assessment
Framework for identifying and mitigating AI-specific risks including bias, explainability, and security.
Process Guide
Certification Process
What to expect during ISO 42001 certification: Stage 1, Stage 2, and ongoing surveillance.
Compliance Guide
EU AI Act Alignment
How ISO 42001 maps to EU AI Act requirements and reduces compliance burden.
Controls Reference
AI Controls Framework
Comprehensive breakdown of ISO 42001 AI management controls and implementation guidance.
Resources
Templates & Downloads
Free ISO 42001 templates, AI use case registers, and policy frameworks.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Everything teams ask before starting an ISO 42001 AIMS engagement.
What is ISO 42001 and how does it relate to AI governance?
ISO/IEC 42001:2023 is the world's first international standard for Artificial Intelligence Management Systems (AIMS). Published by ISO in December 2023, it provides a certifiable framework for the responsible development, deployment and use of AI. It specifies 38 controls organised into 9 control objectives in Annex A (A.2–A.10), covering AI policy, internal organisation, resources, impact assessment, the AI system life cycle, data for AI, third-party use and information for interested parties.
How does ISO 42001 help with EU AI Act compliance?
The EU AI Act is law. ISO 42001 is the management system that operationalises it. The standard's requirements — AI risk and impact assessment, transparency, human oversight, accuracy, robustness, data governance and lifecycle controls — map onto the AI Act's obligations for high-risk systems. Certification does not by itself prove AI Act conformity, but it gives auditors and regulators documented, systematic evidence and closes most governance gaps ahead of harmonised standards.
Who needs ISO 42001 certification?
Organisations that build AI products (LLM apps, ML platforms, AI SaaS, AI agents), companies embedding AI in business-critical or customer-facing operations (fintech, healthtech, SaaS, logistics and cargo, staffing, GTM), EU market entrants, and AI service providers. If you develop, deploy or materially rely on AI systems that affect customers or business decisions, ISO 42001 applies to you.
What do auditors actually check in an ISO 42001 audit?
Auditors verify a complete AI system inventory with documented intended purpose and risk classification for each system, AI impact assessments (Annex A.5) covering affected individuals and society, and evidence of human oversight and accountability. They review the AI policy, data-governance controls for training and operational data, lifecycle controls from design through monitoring and model-drift detection, and your management of third-party and foundation-model dependencies. The AIMS Statement of Applicability and an AI-focused management review are mandatory at Stage 1.
How long does ISO 42001 certification take?
A typical timeline is 8–12 weeks for organisations with basic AI governance already in place: AI system inventory (≈2 weeks), risk and impact assessment (2–3 weeks), controls implementation (≈4 weeks), internal audit (1–2 weeks) and the certification audit (≈1 week). Timeline varies with the number and risk level of AI systems and overall readiness.
What is the difference between ISO 42001 and ISO 27001?
ISO 27001 manages information security. ISO 42001 manages AI specifically — AI governance, ethical and responsible AI, bias mitigation, explainability, impact assessment and AI lifecycle risks. They share the same Annex SL management-system backbone, so they integrate cleanly. Many organisations run ISO 27001 as the security baseline and add ISO 42001 for AI-specific governance.
How much does ISO 42001 certification cost?
At Tranquility, ISO 42001 engagements are scoped to the number and risk level of AI systems and the maturity of your existing governance. This covers consulting (gap analysis, AIMS documentation, AI risk and impact assessments, internal audit) and certification-body coordination. Pricing is all-inclusive and indicative: from $4,000 (₹3–3.5 Lakh) for small organisations, $5,000–6,000 (₹4.5–5 Lakh) for growing companies and $8,000 (₹7–10 Lakh) for large enterprises, including the accredited certification body’s Stage 1 and Stage 2 audit fee. The certificate is issued by that certification body, not by Tranquility Cybersecurity, and the final figure depends on the certification body you choose. Surveillance audits in later years are quoted by the certification body. Request a scoped quote via our contact page.
Keep Exploring
Related Reading.
AI
ISO 42001 Knowledge Hub
AIMS controls, EU AI Act mapping, risk assessment and guides.
Read moreAI
ISO 42001 Certification Guide
From gap analysis to Stage 2 audit — the path to an AIMS certificate.
Read moreAI
ISO 42001 Annex A Controls
The 38 AI-specific controls grouped by domain, mapped to clauses.
Read moreService
ISO 42001 Consulting in India
AIMS implementation from early movers in AI governance.
Read moreSOC 2
SOC 2 for AI Companies
Enterprise AI procurement, model/data security, and ISO 42001 pairing.
Read moreISO 27001
ISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read more