ISO 42001 isn't yet an enterprise requirement. What it covers, how it compares with SOC 2 and AIUC-1, and when it's worth it for an AI company.
Short answer: not yet, for most. ISO 42001 isn't an established enterprise requirement the way SOC 2 and ISO 27001 are. Enterprise buyers occasionally mention it as something that would add confidence in a vendor's AI governance. But it rarely appears as a contractual requirement, and SOC 2 can already cover the technology risks of AI features and agents in production.
ISO 42001 makes the most sense when:
If SOC 2 is your main source of assurance, start by making sure your SOC 2 report properly covers your AI features and agents. If buyers want assurance over how your agents actually behave, look at AIUC-1 as well as, or instead of, ISO 42001.
| ISO/IEC 42001 | |
|---|---|
| What it is | An international standard for an AI management system (AIMS) |
| Published | December 2023 |
| What it certifies | That your organisation governs AI through a defined, working management system |
| What it doesn't certify | That any AI model or feature is safe, accurate, fair or secure |
| Who certifies | Accredited certification bodies, with requirements for those bodies set out in ISO/IEC 42006 |
| Certificate cycle | Three years, with annual surveillance audits, as with other ISO management system standards |
| Controls | 38 controls across 9 areas in Annex A, selected through your risk assessment |
| Closest relative | ISO 27001, which shares the same management system structure |
No, not at this stage. SOC 2 and ISO 27001 are still the frameworks enterprise buyers write into contracts and security reviews. ISO 42001 hasn't reached that point.
The numbers show how early it is. We spoke with three mainstream CPA firms that each serve thousands of clients across SOC 2, ISO 27001, ISO 42001 and other frameworks. As of June 2026, about 60 of their roughly 11,000 clients were pursuing ISO 42001. That's about half of one percent.
Where ISO 42001 does come up with enterprise buyers, it's usually framed as something that would give them more confidence in a vendor's AI governance, not as a condition of the contract. It may become a contractual requirement over time, as SOC 2 did. Whether it will, and how soon, is still to be seen.
Because it's new, and new things get talked about out of proportion to their size.
None of this means ISO 42001 isn't useful. It means the volume of discussion overstates how often buyers actually require it today.
Mostly early adopters looking to get ahead and differentiate. Their reasons are usually a mix of genuine governance benefit and market positioning.
There's real value in having a defined framework for AI governance and an external audit of how it operates. But at this stage, adoption is driven more by positioning and preparation than by enterprise requirements.
ISO 42001 requires an AI management system: the policies, roles, risk processes and controls an organisation uses to govern how it develops, provides or uses AI. It follows the same structure as ISO 27001.
Annex A lists 38 controls across 9 areas. As with ISO 27001, you select the controls that apply based on your risk assessment, and record your choices in a statement of applicability.
| Area | What it covers | Controls |
|---|---|---|
| A.2 Policies related to AI | An approved AI policy and how it aligns with other policies | 3 |
| A.3 Internal organisation | Roles, responsibilities and reporting of concerns | 2 |
| A.4 Resources for AI systems | Data, tooling, computing and people resources | 5 |
| A.5 Assessing impacts of AI systems | Impact assessments on individuals, groups and society | 4 |
| A.6 AI system life cycle | Design, development, verification, deployment, operation and monitoring | 9 |
| A.7 Data for AI systems | Data quality, provenance and preparation | 5 |
| A.8 Information for interested parties | Documentation and information for users and others affected | 4 |
| A.9 Use of AI systems | Responsible use and its objectives | 3 |
| A.10 Third-party and customer relationships | Suppliers, customers and how responsibilities are shared | 3 |
Control counts from the Annex A control list.
ISO 42001 assures your AI governance, not your AI. That distinction matters more than anything else in this article.
Buyers often want assurance over the specific AI features and agents they'll use. Governance assurance alone doesn't give them that, which is where SOC 2 and AIUC-1 come in.
| SOC 2 | ISO 42001 | AIUC-1 | |
|---|---|---|---|
| What it assures | Controls over the system that delivers your service, including AI features and agents in it | How your organisation governs AI | The security, safety and reliability of specific AI agents |
| Form | An auditor's report with a detailed system description and tested controls | A certificate stating the scope of your AI management system | A certificate, backed by technical testing |
| Who sets it | AICPA | ISO/IEC | Artificial Intelligence Underwriting Company (AIUC) |
| Technical testing of AI | Only where AI-specific controls are included and tested | No | Yes: red-team testing, with quarterly retests |
| Enterprise recognition today | Established; widely required in contracts | Early; occasionally requested | Very early |
| Best for | Assurance over your whole service, which enterprises already rely on | AI governance alongside ISO 27001, or as an early-adopter signal | Assurance over how your agents actually behave |
Yes. SOC 2 is the framework enterprises already rely on, and its criteria already cover the technology risks of AI features and agents. The Trust Services Criteria are technology-neutral. When AI is part of the system that delivers your service, the same criteria apply to it:
The SOC 2 report also includes a system description, so it can show buyers exactly where AI sits in your service and how it's controlled. An ISO certificate doesn't do that.
Audit firms should be including AI controls in SOC 2 reports, especially for AI in production. For the detail, see SOC 2 controls and criteria for AI agents in production.
ISO 42001 makes sense when it fits your existing assurance, or when a buyer specifically asks for it. Otherwise, strengthen your SOC 2 first and ask your buyers what they actually expect.
| Your situation | Our recommendation |
|---|---|
| ISO 27001 is your main source of enterprise assurance | Add ISO 42001; the two sit naturally side by side |
| SOC 2 is your main source of assurance | Make sure your SOC 2 covers your AI features and agents first |
| A buyer has explicitly asked for ISO 42001 | Pursue it, and confirm what scope they expect |
| Buyers want assurance over how your agents behave | Consider AIUC-1, which tests the agents themselves |
| No buyer has asked, but you want to stand out | Optional; worthwhile as an early-adopter signal if the investment fits your stage |
| You're preparing for EU AI Act obligations | ISO 42001 helps with evidence, but doesn't give a presumption of conformity on its own |
Because ISO 27001 has no built-in way to show buyers how AI features and agents are controlled, and SOC 2 does.
ISO 42001 and ISO 27001 share the same management system structure, so they can run as one integrated program, with shared policies, risk processes, internal audits and management reviews. ISO 27001's Annex A has no AI-specific controls, and its certificate doesn't describe how each part of your service is controlled. ISO 42001 fills that AI gap for ISO-led companies.
SOC 2 works differently. Its report describes your system and the controls tested within it, so AI controls can be built into the report you already give buyers. For a SOC 2-led company, adding ISO 42001 duplicates more and adds less.
Ask their security or procurement team directly what assurance they expect over your AI features: a framework, specific controls, or answers in their questionnaire. Most buyers are asking about specific risks, such as data use, model providers and agent permissions. A well-scoped SOC 2 report or a clear questionnaire response often answers those better than a governance certificate.
AIUC-1 is a certification standard for AI agents, focused on how the agents themselves behave, not on general governance. It's published by the Artificial Intelligence Underwriting Company (AIUC), which launched it in 2025.
AIUC-1 is closer to what many buyers actually want to know: does this agent behave safely in the way I'll use it? But it's very new. Independent commentators have raised open questions:
Consider AIUC-1 if your product is an agent and buyers are asking specifically about agent behaviour. Pair it with SOC 2, which covers the rest of your service.
No. ISO 42001 is a voluntary standard. No law requires it, and at this stage few enterprise buyers require it in contracts. SOC 2 and ISO 27001 remain the frameworks enterprises rely on.
Very few compared with SOC 2. Across three mainstream CPA firms serving about 11,000 clients between them, about 60 were pursuing ISO 42001 as of June 2026, roughly half of one percent. Adoption is growing from a very small base.
No. ISO 42001 certifies your AI management system: how you govern AI across your organisation. It doesn't test whether a specific model or agent is accurate, secure or safe. For assurance over agent behaviour, look at AIUC-1 or AI-specific controls tested within SOC 2.
No. ISO 42001 isn't a harmonised standard under the EU AI Act, so certification doesn't give a presumption of conformity. It can provide much of the evidence the Act calls for, such as risk management, documentation and oversight.
No. ISO 42001 can be certified on its own. But because the two share the same management system structure, companies with ISO 27001 can extend their existing program rather than building a new one.
Only if a buyer asks for it, or if being an early adopter would help you stand out. For most AI startups, a SOC 2 report that properly covers AI features and agents gives enterprise buyers more of the assurance they're looking for, at this stage.
Possibly. SOC 2 went from optional to expected over several years, and ISO 42001 could follow a similar path. For now, it's early, and whether it becomes a standard contractual requirement is still to be confirmed.
Yes. The SOC 2 criteria are technology-neutral and apply to AI features and agents that are part of your service. Access control, change management, monitoring and vendor management all apply. Your audit firm should include AI-specific controls in the report where AI runs in production.
Former PwC manager, founder of AssuranceLab and former Sensiba partner and Chief Innovation Officer. Now co-founder of Throughline, focused on compliance and assurance for AI-native companies.
SOC 2 for AI-native companies: simpler stacks, agents running the program in your own tools, concise policies, and a report that covers AI in production.
How to cover production AI agents in SOC 2: governance, access, change management and monitoring, with indicative criteria mappings, customer responsibilities and practical audit expectations.
Australian companies need a SOC 2 report issued under the AICPA standards by a US-licensed CPA firm, delivered by a strong local team in Australian time zones. Here's how the provider options compare, and what to check.
Experienced CTOs don't choose a SOC 2 audit firm on price or speed. They look for tech stack expertise, a tailored approach, flexible scheduling, responsiveness and year-round partnership, because those factors decide how much time the audit really costs.
What Security, Availability, Confidentiality, Processing Integrity and Privacy each cover, how often they're included, and how to decide which belong in your SOC 2 report.
Which SOC 2 report should come first? Six client cases, practical decision tables and an illustrative 18-month cost comparison explain when to start with Type 1 and when to go straight to Type 2.
How long a SOC 2 Type 2 observation period should be, how to work backwards from a customer deadline, when auditors test, why reports run late and how much buffer to build in.
A category-by-category SOC 2 budget in USD, covering audit fees, readiness, platforms, penetration testing, consultants, internal assessments and operational costs. Learn what is required, what is optional, and what a quote can leave out.
Five signals of real quality in assurance and security, with practical guidance on building a compliance program that supports customer TPRM, repeatable enterprise reviews and revenue growth.
The person leading your SOC 2 audit is the most underrated factor in choosing an audit firm. Companies compare price, timelines and platform integrations, then barely ask who will actually do the work.
SOC 2 is a risk report, not a certificate. Understand how enterprise customers use it, why having a report is only base camp, and how to turn your audit into a trust asset for growing revenue.
What readiness should cover, when to involve your auditor, which gaps matter most, and how readiness, Type 1 and Type 2 can work as one continuous engagement. A practical guide to preparing for a report your customers can rely on.
CPA firm registration, signing licenses and peer review are the starting point, not proof of quality. A practical guide to checking credentials and asking the questions that matter before choosing your SOC 2 auditor.
Neither is better for everyone. The right choice depends on your customers, how you run security and where you are headed. For AI-native and AI-centric companies, SOC 2's flexible criteria usually make it the stronger starting point.
There's a basic psychology behind why most people don't like audits. Fix this, and people are surprisingly happy to do them again.
Enterprise buyers use SOC 2 as an initial qualifier, then look deeper. A quality report is what carries you through that assessment and turns your compliance investment into real trust.
Audit quality isn't service quality, and it isn't only professional standards. The real test is whether a reader of your report thinks: this tells me what I need to know.
Enterprise security teams review you in the background and rarely give feedback. What they look at beyond SOC 2, what counts as a genuine pen test, and how a quality report does the heavy lifting.
Compliance from first principles, the 95% problem, the compliance metadata AI needs, rethinking screenshots, spreadsheets and policies, and why audits should meet clients where they are.