Buyers Now Ask for ISO 42001. Most Vendors Need the AI Policy Before the Certificate.

A new line is appearing in vendor security questionnaires, usually right after the questions about SOC 2 and ISO 27001: "Are you ISO/IEC 42001 certified?"

Until recently, few buyers asked it. Now compliance firms report AI governance sections turning up in enterprise procurement questionnaires, with the strongest pressure in areas like finance, healthcare and hiring.

The short answer: if you are not ISO 42001 certified, you can still answer the question credibly. Buyers are checking whether you govern AI at all, and a documented AI policy, an approved tools register and review rules for AI-generated code answer most of what they want to know. Certification is worth pursuing later, when a contract requires it.

Still relatively few, although exact figures are hard to pin down. Compliance firm Bright Defense, reviewing official sources in 2026, found no verified global adoption rate, and BCG said in January 2026 that it was among the first 100 organizations certified worldwide.

ISO/IEC 42001:2023 was published on December 18, 2023. It is the first international standard for managing AI inside an organization, the way ISO 27001 covers information security.

Adoption started at the top of the market. AWS announced certification for several AI services in November 2024, Anthropic in January 2025, Snowflake in June 2025 and ServiceNow in December 2025.

If a buyer asks you for ISO 42001 today, they are likely asking your competitors too, and many of them will also answer "no." The difference is what comes after the "no."

ISO/IEC 42001 is a certifiable standard for an AI management system (AIMS). It requires an organization to set an AI policy, assess AI risks and impacts, assign roles and run controls over how AI is built and used, then audit and improve that system over time.

The layout will be familiar to anyone who has worked with ISO 27001, because both follow the same ISO management system structure. Clauses 4 to 10 contain the requirements an auditor checks: scope and context, leadership and the AI policy, planning and risk assessment, resources and documentation, operation (including AI system impact assessments), performance evaluation through internal audit and management review, and improvement.

Annex A adds a reference set of 38 controls under nine control objectives (A.2 to A.10), ranging from AI policy and internal roles to impact assessment, the AI system life cycle, data, use of AI systems and third-party relationships. Not every control is mandatory: you decide which ones apply and justify the choice in a Statement of Applicability.

Three things are worth knowing before anyone in your company promises a date:

For most mid-sized programs starting from zero, implementation firm BD Emerson estimates six to twelve months and $45,000 to $130,000 through certification. With an existing ISO 27001 program, it puts both numbers roughly a third to a half lower. Other firms publish different ranges, because scope and internal staff time vary widely.

Audit capacity is a second constraint. BD Emerson notes that accredited certification capacity for ISO 42001 is still thin, which is worth factoring into any promised date.

For a company that just received a questionnaire with a two-week deadline, the certificate is not the answer to this deal. The answer has to come from somewhere else.

They want evidence that you control how AI touches their data and their product. The certificate is one way to prove it. A procurement team asking about ISO 42001 is usually trying to settle a narrower set of questions about you as a vendor:

A certificate answers all of them at once, with a third party's signature. Without one, the answers come from your own documents. "Not certified yet, here is our AI policy, our approved tools register and our review rule for AI-generated code" reads very differently from a bare "no," or from a paragraph about responsible AI with nothing behind it.

The second question matters more than most teams expect. We covered in an earlier piece how much corporate data already leaks through everyday AI use. A buyer who has read the same numbers wants to know you have rules, not just good intentions.

Six documents answer the core questions in the AI section of a typical vendor questionnaire: an AI acceptable use policy, an approved models and tools register, rules for AI-generated code, a process for citizen developers, a mapping to existing frameworks, and a review and training plan. A baseline set like this can be written in weeks, not months, and most of it is groundwork you would need anyway if you later pursue ISO 42001.

Certification is worth the time and cost when a customer makes it a contractual requirement, when you sell an AI product to regulated buyers, or when you already run ISO 27001. Governance documents are the floor, not the ceiling. In practice, certification starts to make sense when one of these is true:

If none of these apply yet, a sensible order looks like this. Put the baseline policies in place now. Run them for a few months so you have evidence of actual operation: exceptions granted, tools reviewed, training completed. Then decide on certification with real data about your AI use instead of a guess.

No. A policy set is the foundation, but ISO 42001 also expects documented risk and impact assessments, internal audits and management review running on a cycle. Buyers who specifically require the certificate will not accept a policy pack in its place.

What the policy set does give you is an honest, specific answer today, and a head start on the day the certificate becomes a hard requirement. While certification is still relatively rare, a documented answer like that can be enough to keep a deal moving.