Who Can Issue an ISO 42001 Certificate in the UK?
By Alfred Obeng, Founder, Goldline Consultancy
ISO 42001 Lead Implementer (PECB) · ISO 42001 Lead Auditor (PECB) · ISO 27001 Senior Lead Implementer (PECB) · ISO 27001 Lead Auditor (PECB) · CISSP · PMP
7 min read
Contents
Two questions hide inside this one, and they have different answers.
Who can issue you a certificate? Almost anybody. There is no licensing regime for the word certificate, and a body with no oversight of any kind can audit you and issue one.
Who can issue you an accredited certificate? A much shorter list, it changes, and the honest version of this article is that you should not take the list from any consultancy, including this one. What is worth taking is how to check it yourself, and why the list was empty for so long.
Why there were no accredited certificates for two years
ISO/IEC 42001 was published in December 2023. Organisations could implement it immediately, and many did. What could not happen immediately was accredited certification, and the reason is specific rather than bureaucratic drift.
A national accreditation body cannot accredit certification bodies against a standard until the requirements for those certification bodies exist. For AI management systems that document is ISO/IEC 42006:2025, first edition, published July 2025, 31 pages, which sets out the additional requirements for bodies that audit and certify AIMS on top of the general ISO/IEC 17021-1 requirements.
So the sequence ran: the standard organisations certify against, December 2023. The rulebook for the bodies doing the certifying, July 2025. UKAS then announced on 15 January 2026 that it had granted BSI the first accreditation for certification of AI management systems to ISO/IEC 42001:2023.
That is roughly twenty five months in which ISO 42001 certificates existed and accredited ones did not. Anybody who bought one in that window was not misled. They bought the only thing available.
Where UKAS is now
UKAS's own AIMS programme page, updated 25 August 2026, states that it has successfully concluded its pilot accreditation programme for ISO/IEC 42001, that applications remain open, and that assessments are now managed through the UKAS operations team.
In plain terms: the pilot is over, this is now business as usual, and the number of accredited bodies will grow rather than being fixed.
So do not use a list. Use the register.
Any list of accredited bodies published today, on any site, is a snapshot of a moving position, and articles do not update themselves. UKAS maintains the authoritative directory of accredited organisations, and checking it takes about two minutes.
Go to the UKAS site, open the accredited organisation search, and look for certification bodies under management systems, then confirm that ISO/IEC 42001 appears on that body's schedule of accreditation rather than simply on its website. The schedule is the document that says what the accreditation actually covers, and scope matters: a body accredited for ISO 27001 is not thereby accredited for ISO 42001.
If a certification body tells you it is accredited and the standard is not on its schedule, that is not necessarily dishonesty. Accreditation is often in progress and people speak in the present tense about things that are nearly true. It does mean the certificate you receive today would not be an accredited one.
Does accredited actually matter for you?
It depends entirely on who is asking, and it is worth answering that before paying for either.
Where it usually matters: enterprise procurement, regulated sectors, public sector supply chains, and any buyer whose own auditors will look at your certificate. These readers are checking for an accreditation mark and a schedule, because that is what makes a certificate independently meaningful rather than a statement of opinion by a company you paid.
Where it may not: an early customer who wants evidence you have a management system and will read the Statement of Applicability rather than the certificate. Some organisations certify for internal discipline rather than for a buyer at all.
The question to ask is not whether accreditation is better. It is what your buyer will do with the document. Ask them.
Accreditation is not only a UKAS matter
Accreditation bodies in other countries also accredit certification bodies for ISO 42001, and a certificate from one of those is not somehow lesser by being non-UK. Whether a particular certificate satisfies a particular buyer is a question for that buyer's policy, and some do specify their national accreditation body while others accept any recognised one.
What is worth avoiding is the assumption that a foreign accreditation mark is a red flag. Very often it is simply where that certification body is based.
Three questions to ask a certification body
- Is ISO/IEC 42001 on your UKAS schedule of accreditation today, and may I see it? A yes with a document attached ends the question.
- How many audit days does my scope attract, and how did you arrive at that? Audit duration for AIMS certification is governed by ISO/IEC 42006, not by preference.
- What happens at surveillance? Certification is a three-year cycle, and the recurring cost is frequently a surprise to organisations that budgeted once.
One thing this practice cannot do
Goldline is not a certification body in any tense and cannot issue a certificate for anything. Nor can any other consultancy. That separation is structural, and the requirements that create it are worth reading if anybody has suggested otherwise to you.
What a consultancy can do is get you ready, tell you how many audit days your scope should attract before you ask for a quote, and stay out of the way of the body that makes the decision. The three exercises are different things, and only one of them produces a certificate.
Sources
- ISO catalogue entry for ISO/IEC 42006:2025, information technology, artificial intelligence, requirements for bodies providing audit and certification of artificial intelligence management systems. First edition, published July 2025, 31 pages. Read 1 September 2026.
- UKAS, "UKAS grants first accreditation for ISO/IEC 42001", published 15 January 2026: "UKAS has granted BSI the first accreditation for certification of artificial intelligence (AI) management systems to ISO/IEC 42001:2023." Read 1 September 2026.
- UKAS, ISO/IEC 42001 Artificial Intelligence Management Systems development programme page, last modified 25 August 2026, stating that the pilot accreditation programme has concluded, applications remain open, and assessments are managed through the UKAS operations team. Read 1 September 2026.
- ISO/IEC 42001:2023 was published in December 2023.
- ISO/IEC 42006:2025 and ISO/IEC 17021-1:2015 are not published free of charge and are not quoted here beyond the catalogue description.
- No list of currently accredited bodies is given in this article, deliberately. The UKAS directory is the only authoritative source and it changes.
Alfred Obeng
Founder of Goldline Consultancy. ISO 42001 Lead Implementer (PECB), ISO 42001 Lead Auditor (PECB), ISO 27001 Senior Lead Implementer (PECB), ISO 27001 Lead Auditor (PECB), CISSP, PMP.
Related reading
7 min read
What ISO 42001 Costs in the UK
By Alfred Obeng, Founder and Principal Consultant
CISSP | ISO 27001 LI & LA | ISO 42001 LI & LA | PMP
Four different costs with four different owners, and only two of them are published by anyone. How to separate them, and the two variables that actually move your total.
- ISO 42001
- Pricing
- Certification
- AI Governance
8 min read
Can the Consultancy That Built Your AIMS Also Audit It?
By Alfred Obeng, Founder and Principal Consultant
CISSP | ISO 27001 LI & LA | ISO 42001 LI & LA | PMP
The rule everyone quotes is about your certification body, not your consultant. What ISO/IEC 17021-1 actually restricts, and where the real constraint lands.
- ISO 42001
- Internal Audit
- Certification
- AI Governance
12 min read
How to Choose an ISO 42001 Consultant in the UK
By Alfred Obeng, Founder and Principal Consultant
CISSP | ISO 27001 LI & LA | ISO 42001 LI & LA | PMP
Six things to check before you engage an ISO 42001 consultant, including the independence rule in ISO/IEC 42006 that decides who is allowed to audit what they built.
- ISO 42001
- AI Governance
- Procurement
6 min read
Readiness Assessment, Internal Audit, Certification Audit: Three Different Things
By Alfred Obeng, Founder and Principal Consultant
CISSP | ISO 27001 LI & LA | ISO 42001 LI & LA | PMP
Three exercises, three purposes, three different answers to who is allowed to perform them. The test that cuts through it is asking what the report is evidence of, and to whom.
- Certification
- Internal Audit
- ISO 27001
- ISO 42001
11 min read
ISO 27001 vs ISO 42001: What Each Standard Actually Governs
By Alfred Obeng, Founder and Principal Consultant
CISSP | ISO 27001 LI & LA | ISO 42001 LI & LA | PMP
The practical difference between an information security management system and an AI management system, where the controls overlap, and which one to implement first.
- ISO 42001
- ISO 27001
- AI Governance
