Career Development Hub

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Since this is indeed a new area, I would start by reviewing the concepts and terminology as described in ISO/IEC 22989:2022 Information Technology - Artificial Intelligence. Annex A shows a diagram of the AI system lifecycle. This guidance document might be used to conduct the audit as it gives the framework of the AI process.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Good Morning, Ramin. Happy 2026 to you, Sir!

I truly appreciate the fact you took time to provide such an in-depth response to my questions.  It does not go without saying, and one of the reasons I love being an ISO auditor, is this sharing of information and experience with one another.  

Considering the newness of the standard, I want to take to best approach for learning and spending money on training.  The exact question you provided will definitely be asked of all potential training bodies I vet.  Thank you for that!!!

I wish you the very best this year and along your journey.

Thanks again!  BK

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Dear Billie,

I conduct ISO 42001 - Artificial Intelligence Management System - Lead Auditor and Lead Implementer Workshops. 
I conduct these workshops routinely and have worked with several participants and large organisations.

I have consulted, implemented, trained and audited AIMS for large organisations and done several open - house workshops as well.

In case you have any specific questions, I will answer your queries to assist you in your decision making.

Good Morning, Ramin. Happy 2026 to you, Sir!

I truly appreciate the fact you took time to provide such an in-depth response to my questions.  It does not go without saying, and one of the reasons I love being an ISO auditor, is this sharing of information and experience with one another.  

Considering the newness of the standard, I want to take to best approach for learning and spending money on training.  The exact question you provided will definitely be asked of all potential training bodies I vet.  Thank you for that!!!

I wish you the very best this year and along your journey.

Thanks again!  BK

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Hi, so Exemplar does not provide this certification not any training, correct? I am a little confused, as a trainer told me they would get a link generated form Exemplay for my ISO 42001 LI (Lead Implementer) certificate! Could some one help?

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

I took the Training and gave the exam, and I got the certification from exemplar global, but the way this exam was conducted. It didn't seem to be genuine.

I would like to hear more from you, if possible, please email me

Hi, so Exemplar does not provide this certification not any training, correct? I am a little confused, as a trainer told me they would get a link generated form Exemplay for my ISO 42001 LI (Lead Implementer) certificate! Could some one help?

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Hi, so Exemplar does not provide this certification not any training, correct? I am a little confused, as a trainer told me they would get a link generated form Exemplay for my ISO 42001 LI (Lead Implementer) certificate! Could some one help?

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Hi, so Exemplar does not provide this certification not any training, correct? I am a little confused, as a trainer told me they would get a link generated form Exemplay for my ISO 42001 LI (Lead Implementer) certificate! Could some one help?

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK

Happy New Year! Obtaining ISO 42001 (Artificial Intelligence Management System) is a significant move, especially as the standard is still fresh in the industry. Because it was only published in late 2023, the pool of certified organizations and registrars is currently small but growing rapidly.

Here is feedback based on the current market landscape for ISO 42001 in the US.

1. Registrars (Certification Bodies) in the US

You are correct that the list is shorter than for mature standards like ISO 9001 or ISO 27001. However, several major players have moved quickly to get accredited by ANAB (ANSI National Accreditation Board) for ISO 42001.

• Schellman: They were the first certification body in the US to achieve ANAB accreditation for ISO 42001. If you want a registrar with the most immediate experience in this specific niche, they are a primary option.

• Perry Johnson Registrars (PJR): Another major US-based registrar that is actively quoting and auditing for ISO 42001.

• A-LIGN: A well-known firm in the tech compliance space (SOC 2, ISO 27001) that has added ISO 42001 to their portfolio.

• Lazarus Alliance: They market themselves aggressively on "proactive cybersecurity" and have added ISO 42001 accreditation.

• Global Firms with US Presence: Large international registrars like BSI (who certified Darktrace, one of the first AI security companies to get it), DNV, and TÜV SÜD are also active in the US market.

Tip: When vetting them, specifically ask: "Are you currently ANAB accredited for ISO 42001, or is your application pending?" Some firms may sell you the audit while they are still in the "witness audit" phase of their own accreditation.

2. In-Person vs. Virtual Audits

For ISO 42001, the trend is heavily leaning toward Virtual or Hybrid, predominantly because:

• Nature of the Evidence: unlike a manufacturing standard (ISO 9001) where an auditor needs to walk a factory floor, ISO 42001 evidence is digital (algorithmic impact assessments, risk logs, data governance policies, MLOps dashboards).

• Auditor Availability: Since qualified ISO 42001 auditors are scarce, registrars often fly them in virtually rather than physically to keep costs reasonable and schedules tight.

Exception: If your AI system involves physical hardware (e.g., robotics, autonomous vehicles, or on-premise data centers that aren't already covered by other certs), a registrar may insist on an on-site visit.

3. Experience Auditing to a "New" Standard

The "newness" of the standard creates a unique dynamic during the audit. Here is what early adopters and auditors are reporting:

• Interpretation is Fluid: unlike ISO 27001, where controls are black and white, ISO 42001 controls (like "AI System Impact Assessment") are still open to interpretation. You might find auditors are more collaborative than usual because they are learning the practical application alongside you.

• Scope Creep is the Enemy: The biggest challenge is defining the "boundary" of the AI system. Auditors will drill down hard on this. Are you certifying all AI in your company, or just one specific model/product? If you don't define this clearly in your "Context of the Organization," the audit can spiral.

• Documentation vs. Reality: Since historical data is scarce for a new system, auditors are focusing heavily on the Risk Assessment framework (specifically the AI Risk Treatment Plan). They want to see that you have a mechanism to catch "Hallucinations," "Bias," or "Model Drift," even if you haven't had a major incident yet.

• Integration with ISO 27001: If you already have ISO 27001 (Information Security), the audit is significantly smoother. Many auditors will accept your existing ISMS (Information Security Management System) policies for the "governance" side (document control, internal audit, leadership reviews), allowing them to focus purely on the AI-specific controls (Annex A and B).

Summary Advice

If you are selecting a registrar now, look for one that views the audit as a "partnership" rather than a checklist, given the interpretive nature of the standard.

Happy New Year!

I have an interest in obtaining ISO 42001 Information technology - Artificial intelligence - Management system.

For those that have obtained this certification in the US, what registrar did you use?  I ask because my investigation on the EG site netted a very small number of registrars within the US.  Also, if you obtained it, was it in person or virtual?

Secondarily, for any one that has obtained this certification, what is your experience auditing to it considering the subject being so very new?

Any and all feedback is greatly appreciated!

Thank you and blessing to all.  BK