ISO/IEC 42001 is the world's first international standard for AI Management Systems. As organisations race to adopt AI, certification proves you're doing it responsibly — to clients, partners, and regulators.
One standard, three distinct needs. Whether you’re starting from scratch, preparing for an audit or managing an existing certification, choose the support that fits where you are today, with a clear scope and tangible outputs, shaped around your business, risks and deadline.
Build an AIMS your team can run and an auditor can test, delivered by senior practitioners.
Know where you stand before the auditor does, with an independent, evidence-based view of your AIMS against ISO/IEC 42001:2023.
Keep your certification valid and your AIMS audit-ready as AI systems, models, suppliers and regulations change, without the scramble before each audit.
Exact deliverables are confirmed in your proposal after scoping.
Your budget should account for three elements: consultancy support, the certification body’s fees and your organisation’s own implementation effort.
Bitsecura provides a tailored quote after scoping your requirements. The fee depends on the services you need, the complexity of your organisation and how much work your team has already completed.
| What affects the fee | Why it matters |
|---|---|
| Scope and complexity | Multiple locations, AI systems and use cases require more assessment and coordination. |
| Existing AI governance | Established AI oversight, risk practices and usable evidence can reduce the work required. |
| Internal capacity | Some teams need targeted advice; others need more implementation support. |
| Engagement type | A standalone internal audit has a different scope from implementation or ongoing maintenance. |
| Delivery requirements | Delivery is remote by default. Any on-site activity identified during planning, and additional audit support, affect the fee. |
Your proposal should make clear the deliverables, responsibilities, delivery arrangements, fees and any separately priced activities.
Your Bitsecura fee covers the work listed in your proposal. Three other costs sit outside it, and the first is the one clients most often confuse with consultancy fees.
Workshops, document reviews, evidence assessment and many audit interviews can be delivered remotely. We agree meeting times, evidence-sharing arrangements and milestones with your team.
Where physical controls or operational activities need on-site assessment, we identify that requirement during planning. Your certification body determines the arrangements for its own assessment.
Every engagement is led by Arian Sheremeti, Bitsecura’s Principal GRC Consultant and Auditor, with more than 20 years of experience and a background at PwC and Deloitte.
You get a senior ISO 42001 Lead Auditor from the first scoping conversation, not a hand-off to a junior team. We work in a documented, repeatable way, and your policies, risk register and evidence stay in your own systems, so the AIMS belongs to your organisation.
There is no single answer. Your timeline depends on the agreed scope, existing controls, internal availability and the certification body’s schedule. We agree a realistic plan with you during scoping.
A credible plan allows time to implement controls, collect operating evidence, complete the internal audit and management review, and address findings.
The AI Act is law with its own conformity requirements; ISO 42001 is a voluntary management system. They are complementary: the AIMS gives you the governance structure (inventory, risk assessment, oversight, documentation) that makes AI Act obligations manageable rather than a scramble.
Yes, and it should be. Both follow the same harmonised management-system structure, so policy governance, risk methodology, internal audit and management review can be shared. An integrated audit programme is cheaper than two parallel ones.
An external certification body conducts the certification assessment and decides whether to issue the certificate. Bitsecura provides implementation, internal audit and readiness support.
You can read more about the distinction in ISO’s guidance on certification.
No. Your organisation can maintain its own AIMS if it has the capacity and competence. Ongoing support is useful when you need additional expertise, independent internal audits or help coordinating maintenance activities.
Tell us whether you need implementation, an internal audit or ongoing AIMS support. We will discuss your existing arrangements and the outcome you need.
Book a free discovery call