Short answer
A 5-person AI startup with SOC 2 already in place can be ISO 42001-ready in 3–6 months for roughly $25,000–$75,000 all-in (audit + tooling + internal time). The work that doesn't exist elsewhere is AI-specific: impact assessments per model, dataset data-sheets, an evaluation and red-team log, and a human-oversight runbook. Everything else (access control, change management, vendor reviews) carries over from SOC 2 or ISO 27001. Ship SOC 2 first unless your first enterprise RFP is from an EU or regulated-industry buyer.
Do enterprise buyers actually ask for ISO 42001?
In 2026, three signals say yes:
- Vanta published its Agentic Trust Controls (65 controls, 12 domains); 43 of those sit inside the ISO 42001 baseline (source). A direct citation of ISO 42001 by a major compliance platform is a proxy for RFP demand.
- The AICPA's 2027 SOC 2 exposure draft adds 7 AI points of focus — AI governance, model monitoring, prompt manipulation, data poisoning, AI output transparency, training data, automated decision-making. The AI governance point of focus explicitly cites ISO 42001 as a reference.
- The EU AI Act Digital Omnibus pushed high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). European buyers use "ISO 42001 or equivalent" as shorthand for AI Act readiness — an escape hatch that narrows the closer those dates get.
Who's asking today: EU enterprise procurement, regulated industries (banking, healthcare, pharma), government contractors in the UK and Singapore, and Fortune 500 companies with a named Head of AI Governance.
Scoping an AIMS for a small team
The AI Management System (AIMS) is your organisational wrapper for responsible AI. For a 1–10 person startup, four scoping decisions make the difference between a 6-month project and a 3-month one.
- Pick the models in scope. Only production models that touch customer data or affect customer outcomes. Internal tooling (code review, document drafting) sits outside scope for the first cycle.
- Name one AI owner. Usually a founder, head of engineering, or head of product. The management-system clauses require accountability; a named owner collapses all of them.
- Reuse the ISMS calendar. If you run ISO 27001 or SOC 2 reviews quarterly, run AIMS reviews on the same calendar. Same meeting, same minutes, different agenda item.
- Draft a one-page intended-use statement per model. This feeds the AI impact assessment, the model card, and any EU AI Act transparency obligation that might apply.
Required documents (AIMS pack)
Four core policies plus four evidence artefacts cover the whole management system. Everything else is operational logs that an auditor samples.
| Document | What it contains | ISO 42001 anchor |
|---|---|---|
| AI policy | Scope, objectives, responsibilities, review cadence. | Clause 5.2, A.2 |
| AI risk-management procedure | How risks are identified, assessed, treated, reviewed. | Clause 6.1, A.2 |
| AI impact-assessment template | Intended use, affected parties, foreseeable harms, mitigations. | A.5 (AI System Impact Assessment) |
| Statement of Applicability | Every Annex A control mapped applicable/not-applicable with one-line justification. | Clause 6.1.3 |
| AI inventory | One row per production model: owner, intended use, risk tier, data flows. | A.6, A.7 |
| Dataset data-sheets | Source, licence, consent basis, quality metrics per training corpus. | A.7 (Data for AI systems) |
| Evaluation report | Accuracy, robustness, bias and red-team findings — one per model release. | A.6.2.4 |
| Human-oversight runbook | Who approves what action at what threshold; incident-response playbook. | A.9 (Use of AI systems) |
See the ISO 42001 Annex A glossary entry for the full 38-control list.
What carries over from SOC 2 (and what doesn't)
Teams holding SOC 2 Type 2 reuse about 40–50% of their evidence base for ISO 42001. The dividing line is clean: management-system scaffolding and information-security controls carry over; AI-specific governance is net-new.
| Domain | ISO 42001 anchor | SOC 2 reuse |
|---|---|---|
| Access control | Inherits ISO 27001 / SOC 2 controls | Full — no rewrite |
| Change management | Annex A.6.2 (model changes) | Add model-version pin + prompt review to existing CC8.1 workflow |
| Vendor management | Annex A.10 (supplier relationships) | Extend CC9.2 reviews to cover LLM providers (DPA, no-training clause) |
| Monitoring & incident response | A.6 lifecycle, A.9 use | Add AI-specific scenarios (prompt injection, drift, model-provider outage) to CC7.2 |
| Risk assessment | Clause 6.1 (AI-specific risks) | Parallel register — same cadence, different threat model |
| Impact assessment | A.5 | New — no SOC 2 analogue |
| Model & data lifecycle | A.6, A.7 | New — no SOC 2 analogue |
| Transparency to users | A.8 | New — no SOC 2 analogue |
See the forthcoming SOC 2 ↔ ISO 42001 crosswalk for the full CC1–CC9 to clauses 4–10 and Annex A mapping, plus a downloadable sheet.
Timeline for a 5-person AI team (with SOC 2)
Scope & gap analysis
Name an AI owner, inventory every production AI system, pick one or two to put in scope. Run a gap analysis against ISO 42001 Annex A — the output is a checklist, not a verdict.
AIMS policy pack
Write or adopt the core documents: AI policy, AI risk-management procedure, AI impact-assessment template, Statement of Applicability. Four documents cover roughly 20 Annex A controls.
Impact assessments & dataset data-sheets
Complete one AI impact assessment per in-scope model. Attach a dataset data-sheet (source, licence, consent basis, quality metrics) for every training or fine-tuning corpus.
Evaluation & monitoring evidence
Produce the evaluation report — accuracy, robustness, bias dimensions, red-team findings. Turn on drift monitoring and configure incident-response for AI-specific failure modes.
Internal audit & Stage 1 readiness
Internal audit against the SoA; close any findings. Pick an accredited certification body, book Stage 1 (documentation review), target Stage 2 (implementation audit) 4–8 weeks later.
Timeline assumes an existing SOC 2 / ISO 27001 ISMS. Starting from zero, double the implementation window.
What LowerPlane automates
- ✓AI inventory — one row per model, linked to integration-synced evidence (vendor DPA, model version, drift config).
- ✓AI impact assessment templates per use-case category (classification, generation, decisioning).
- ✓Statement of Applicability — generated from control-implementation status.
- ✓Dataset data-sheet templates.
- ✓Evaluation-report tracking — the Nov SOC 2 TSC AI points of focus use the same evidence.
- ✓Red-team and prompt-injection test logs, versioned alongside the policy pack.
- ✓Vendor DPAs for LLM and embedding providers, re-reviewed annually.
- ✓Combined ISO 27001 / ISO 42001 audit calendar.
Next step: the audit
Readiness is one half; the certification audit is the other. Stage 1 is a documentation review; Stage 2 is the implementation audit. Pick an accredited certification body (UKAS, ANAB, or an equivalent IAF-member accreditation authority) early — CB lead times run 6–10 weeks for Stage 1 bookings.
Need an auditor?
We work with ISO 42001 auditors across the US, EU and Singapore. For the audit side of the engagement, our sister site auditxyz.com matches startups to accredited certification bodies with ISO 42001 experience. (Related site disclosure: auditxyz.com is operated by the LowerPlane team.)
Frequently asked questions
Is ISO 42001 mandatory?
No. ISO 42001 is a voluntary international standard — there is no law that requires certification. It becomes effectively required when a buyer's procurement contract names it (common in EU, regulated industries, and large enterprises with an AI governance committee) or when a procurement checklist uses "ISO 42001 or equivalent" and the buyer tightens that later.
Can a 3-person startup certify?
Yes. The management-system requirements scale — a 3-person team runs lighter governance ceremonies (one weekly review instead of quarterly committees), has a single named AI owner, and scopes the AIMS to one or two production models. Accredited certification bodies routinely certify startups under 10 people; the audit is proportionate to scope.
ISO 42001 or SOC 2 first?
For most US AI startups, SOC 2 Type 2 first — it is cheaper, faster, and the buyer base recognises it. ISO 42001 second, when a specific EU or regulated buyer asks. Reverse the order only if your first enterprise RFP comes from a European buyer or a regulated-industry procurement team that writes ISO 42001 into the contract.
Does ISO 42001 cover the EU AI Act?
Not literally, but materially overlapping. The EU AI Act mandates a risk-management system, data governance, logging, human oversight and transparency. ISO 42001 Annex A controls map cleanly onto those obligations, which is why European buyers commonly ask for "ISO 42001 or equivalent" as shorthand for "demonstrate your AI Act readiness." The Digital Omnibus pushed Annex III obligations to 2 December 2027 and Annex I to 2 August 2028 — the window to get certified before most high-risk duties bite closes in 2027.
Can one audit cover both ISO 27001 and ISO 42001?
Yes. Both are Annex SL management-system standards, so accredited certification bodies run combined or integrated audits. The management-system clauses (4–10) are evaluated once; the Annex A controls are evaluated per standard. Combined audits usually save 20–30% of the stand-alone cost.
What does ISO 42001 certification cost for a startup?
Three line items. Accredited certification body audit for a sub-100 FTE org: $15,000–$50,000 (request 2–3 quotes). Implementation support (platform or consulting): $10,000–$60,000 depending on existing ISMS maturity. Internal time: 0.5–1 FTE for 4–8 months. All-in first year without a prior ISMS: $45,000–$130,000. With ISO 27001 already in place: $25,000–$75,000.
Ready to scope ISO 42001 for your team?
Book a 20-minute call with a compliance advisor who has run ISO 42001 scoping for AI startups facing their first EU or regulated-industry RFP.
Book a Demo