ISO 42001 vs SOC 2: which should an AI startup do first?
ISO 42001 certifies an AI management system; SOC 2 is an attestation on your service's controls. For most AI startups selling to US enterprise, do SOC 2 Type 1 first (30–60 days to a signable report) and layer ISO 42001 on a 4–6 month cadence. For EU-first teams or teams where buyers already ask for AI governance, run ISO 42001 in parallel. 50–65% of evidence overlaps once the AI is in SOC 2 scope.
The question “which comes first, ISO 42001 or SOC 2” wasn't really available in 2024 because ISO 42001 was still too new. In 2026 it's a real decision: certification bodies are accredited, ISO 42001 is on enterprise procurement checklists, and the AICPA has issued TQA 9561 that puts AI explicitly in SOC 2 scope. This piece lays out the difference, the overlap, the cost and timeline, and a decision table for AI startups between 5 and 100 people.
Side-by-side
| Factor | ISO 42001 | SOC 2 |
|---|---|---|
| What it is | Certification of an AI management system against ISO/IEC 42001:2023 | Attestation report on controls against AICPA Trust Services Criteria |
| Scope | AI governance, lifecycle, risk management, data quality, impact assessment, continual improvement | Security (required) + Availability, Processing Integrity, Confidentiality, Privacy (optional) |
| Issued by | Accredited certification body (ANAB, UKAS, DAkkS, etc.) | Licensed CPA firm registered with AICPA |
| Output | Certificate (public), surveillance report (internal) | Attestation report Type 1 or Type 2 (NDA-protected) |
| Duration | Certificate valid 3 years with annual surveillance audits | Report typically valid 12 months (then bridge letter → next report) |
| Timeline from cold start | 4–6 months to certification | 30–60 days to Type 1; 3–12 months to Type 2 |
| Typical total cost | USD 20k–60k year 1 depending on scope and body | USD 15k–40k year 1 (Type 1 + Type 2) depending on scope |
| Mandatory statement | Statement of Applicability (Annex A controls) | System description |
| Repeat cadence | Annual surveillance; full recertification every 3 years | Annual Type 2 report with 12-month observation window |
Certification vs attestation: why it matters
ISO 42001 is a certification issued by a certification body against a published standard. The output is a certificate you can show publicly, listed in the certification body's register, with a defined validity period. The audit is a prescribed Stage 1 (documentation review) and Stage 2 (implementation audit), followed by surveillance audits each year of the 3-year cycle.
SOC 2 is an attestation issued by a licensed CPA firm under AICPA standards (SSAE 18). The output is a report describing the service, listing the controls, and giving an opinion on whether those controls were suitably designed (Type 1) and operated effectively (Type 2). The report is confidential; you distribute it to prospects under NDA.
For procurement, both answer the same buyer question (“is this vendor safe to buy from?”) in different ways. ISO 42001 is a yes/no public signal. SOC 2 is a 60–120 page document the buyer's security team actually reads.
Scope: what each actually covers
ISO 42001 is purpose-built for AI. The management-system clauses (4–10) require you to establish AI governance, define AI policies, assess AI risks and opportunities, allocate resources to the AI programme, operate the AI lifecycle under control, monitor and measure the AI management system, and continually improve it. Annex A lists specific AI controls across governance, resources, impact assessment, lifecycle, data, information for interested parties, use of AI systems, and third-party relationships.
SOC 2 is purpose-built for service-organisation security and operations. The Trust Services Criteria cover security (always), availability, processing integrity, confidentiality and privacy. SOC 2 doesn't care how your AI is governed as a product — it cares that the controls around the service, including any AI inside the service, meet the criteria. The AICPA's TQA 9561 clarified in September 2026 how AI slots into existing criteria.
The overlap is in the operational parts of both: risk management, change control, incident response, access control, vendor management and continuous monitoring produce evidence both auditors want.
Timeline and cost
A SOC 2 Type 1 can be ready in 30 days from a cold start if you have the right platform and a motivated team — scope lock in week 1, policy pack and integrations by week 2, evidence by week 3, auditor fieldwork by week 4. SOC 2 Type 2 adds the observation window (3 months minimum; 6–12 months typical) during which your controls must operate continuously.
ISO 42001 is harder to short-circuit because of the Stage 1 / Stage 2 audit model. Realistically plan on 4–6 months end to end: 2–3 months to stand up the management system, 1 month to run an internal audit cycle, 1–2 months to schedule and complete Stage 1 and Stage 2 with the certification body. The output is a certificate you can send on day one of any sales conversation.
Total cost in the first year is usually comparable: USD 20k–60k for ISO 42001 (certification body + internal effort), USD 15k–40k for SOC 2 Type 1 + Type 2 (auditor + readiness). Platforms like LowerPlane change the internal-effort side; the auditor and certification-body costs are external and relatively fixed.
Control overlap for AI startups
| Area | ISO 42001 | SOC 2 | Reusable evidence |
|---|---|---|---|
| AI risk management | 6.1, 8.2 | CC3.1 | Risk register with AI entries |
| Access control | Annex A A.7 | CC6.1, CC6.3 | IdP user list, quarterly access review |
| Change management | 8.3, Annex A A.6 | CC8.1 | PR review history, deploy logs |
| Monitoring | 9.1 | CC7.2 | SIEM dashboards, alert history |
| Incident response | 8.4 | CC7.3, CC7.4 | Runbooks + post-incident reports |
| Vendor review | Annex A A.10 | CC9.2 | Vendor file + annual review |
| Data governance | Annex A A.7 | C1.1, P4.1 | Data flow diagrams + classification |
| AI impact assessment | Annex A A.5 | N/A (new in TSC revision) | AIIA documents per AI feature |
| Human oversight policy | Annex A A.9 | CC5.3 | AI use policy + per-feature oversight model |
Decision table: which first?
| Your situation | Start with | Then add |
|---|---|---|
| US-first AI startup, enterprise contracts coming | SOC 2 Type 1 | SOC 2 Type 2 + ISO 42001 |
| EU-first AI startup or already ISO 27001 certified | ISO 42001 | SOC 2 for US expansion |
| Agent/autonomous features, high buyer scrutiny on AI | Both in parallel | Run on one evidence base |
| Already SOC 2 Type 2, adding AI features | ISO 42001 | Extend SOC 2 scope to AI |
| Pre-revenue, building toward enterprise | SOC 2 Type 1 | ISO 42001 when buyers ask |
Common misconceptions
“ISO 42001 will replace SOC 2 for AI companies.” It won't. SOC 2 is the US procurement default and the AICPA has signalled a Trust Services Criteria revision in 2027 that will add AI-specific points of focus. Enterprise buyers will keep asking for SOC 2 reports for the foreseeable future.
“ISO 42001 is only for AI providers, not AI users.” ISO 42001 covers organisations that develop, provide or use AI systems. If you use third-party AI materially in your business, the AI management system still applies.
“If I do ISO 27001 I don't need ISO 42001.” ISO 27001 is an information security management system; ISO 42001 is an AI management system. They're cousins (same clause structure, same auditor model), but they certify different things. Most AI organisations with ISO 27001 add ISO 42001 within 6–12 months.
Frequently asked questions
Is ISO 42001 a replacement for SOC 2?
No. ISO 42001 certifies an AI management system — governance, risk management and lifecycle controls specifically for AI. SOC 2 is an attestation report on your controls against the Trust Services Criteria for the service as a whole. They cover different scopes and most AI startups selling into enterprise end up doing both.
Which do enterprise buyers ask for more often?
SOC 2 is still the default US buyer request. ISO 42001 is a strong supplement that EU buyers, large-financial-services buyers and procurement teams with an AI governance checklist have started requiring in 2025–2026. If you can only do one in the next six months, start with SOC 2 unless your contracts explicitly ask for ISO 42001.
How much evidence overlaps between ISO 42001 and SOC 2?
For an AI startup, 50–65% of evidence overlaps once the AI is in scope: risk assessment, change management, access control, incident response, vendor review and continuous monitoring satisfy both. The ISO 42001-only additions are the AI management system clauses (6–10) and Annex A AI-specific controls. The SOC 2-only additions are the system description, carved-out subservice organisations and the specific point-of-focus evidence.
Can one audit cover both?
No single audit covers both — ISO 42001 is a certification by an accredited certification body and SOC 2 is an attestation by a licensed CPA firm. But you can run a single evidence programme and single internal readiness project that produces artefacts both auditors accept. Running them within the same quarter is common.
How long does ISO 42001 take vs SOC 2?
ISO 42001 Stage 1 + Stage 2 certification is typically 4–6 months from a cold start, with ongoing surveillance audits annually and recertification every 3 years. SOC 2 Type 1 can be ready in 30 days once scope is locked; SOC 2 Type 2 requires a 3–12 month observation window. SOC 2 Type 1 is the faster path to an enterprise-signable report.
What about ISO 27001 — do I need all three?
If you already have ISO 27001, ISO 42001 is a management-system extension that reuses most of your governance plumbing. If you have SOC 2 and are adding AI features, ISO 42001 is the cleanest internal frame for AI governance even if the buyer never asks for it. See our ISO 42001 90-day roadmap for the sequencing.