ISO 42001 for consultants
If you implement ISO/IEC 42001 for clients, the one-time toolkit licences do not cover you. This page explains what does, what your client receives, and what it costs. Updated 30 July 2026 · 5 min read
Start here: the one-time licences do not cover client work
The Starter, Professional and Audit-Ready tiers grant a perpetual licence limited to a single organisation's own implementation. That is the right licence if you are certifying your own company. It is the wrong licence if you are a consultant, because delivering adapted documents into a client's management system falls outside it.
We would rather say that plainly on a public page than have you discover it in section 5 of the Terms after you have paid. If you bought a one-time tier and have been using it for client work, write to us and we will move you onto the correct licence for the remainder of your update window at no charge.
Practitioner Licence — $2,400/year
For one named individual: independent consultants, Lead Auditors moving into implementation work, fractional AI governance leads.
- Unlimited client engagements. Adapt the documents to each client's context and deliver them as an engagement deliverable.
- Your client keeps the documents permanently, including after your engagement ends and when presenting them to a certification body. They do not receive the source toolkit or the right to reuse it elsewhere.
- Everything in Audit-Ready — all 23 AIMS documents, 9 Annex A deep-dives, 7 clause playbooks, the four-way crosswalk, the 64-formula gap analysis workbook, three industry variants, the Microsoft SSPA Section K mapping, and the Stage 1 and Stage 2 evidence binders.
- Continuous updates while subscribed, not a 24-month window. When a regulation moves, your live engagements move with it.
- A per-engagement changelog letter you can hand a client, explaining exactly what changed in their documentation and why.
Prefer email? hello@iso42001toolkit.com
Practice Licence — $7,500/year, up to 10 consultants
For consultancies standardising delivery across a team.
- Everything in the Practitioner Licence, for up to ten named individuals in one legal entity.
- Seats are reassignable when someone leaves, but not shared concurrently.
- Co-branded cover pages — "Implementation documentation by HumanAudit, delivered by [your firm]".
- Named support and an onboarding session for the delivery team.
We do not offer full white-labelling, and that is deliberate. The reason to use our documents rather than someone else's is that they are visibly ours and visibly corrected in public. Documents with our name stripped off carry none of that, and neither of us benefits.
Prefer email? hello@iso42001toolkit.com
The arithmetic
ISO 42001 implementation engagements run roughly $20,000–$80,000 depending on scope, with gap analysis alone at $5,000–$15,000 standalone. Four engagements a year at the lower end is $80,000 of billings.
The Practitioner Licence is 3% of that, and it removes the four-to-eight weeks of documentation drafting from every engagement. The question is not whether it pays for itself. It is whether the documents survive an audit — which is the next section.
Before you put your name on it
You are the one in the room when the auditor pulls a thread. So the question that matters is not what is in the document set. It is what happens when something in it is wrong.
In version 2.3, a customer told us AIMS-06 referenced treatment actions by identifier without describing them. He was right. We audited the whole set, found two further defects he had not spotted, and shipped the correction free to every existing customer with a written account of what had been wrong.
In version 2.5 we found a second defect, of the same class, that our own 2.3 audit had missed: nine risk scores in AIMS-06a did not match the register they cited. The 2.3 audit traced every identifier in both directions. It did not trace the values carried alongside them. Those are different tests and we had only run the first.
Both accounts are public, with control IDs, on the changelog. We have also published the automated check that now runs before every release and would have caught both.
If you are evaluating anyone's templates — ours or a competitor's — ask them to tell you about a time their templates were wrong. If they cannot answer, they have not looked.
Certification bodies and auditors
A certification body may license the toolkit for internal auditor competence, training and calibration in support of ISO/IEC 42006:2025, which sets more prescriptive competence requirements for personnel involved in certification activities than its draft did.
No HumanAudit licence permits a certification body to provide management system consultancy to an organisation it audits or certifies. ISO/IEC 17021-1 impartiality obligations remain entirely yours. Book a call to talk through what your accreditation assessor will expect to see.
Common questions
Can I use a one-time tier for one client, just to try it?
No. Buy a Practitioner Licence and cancel after a year if it does not work for you. The 7-day money-back guarantee applies to it in the same way it applies to everything else we sell.
What if I stop renewing?
Documents already delivered to clients are unaffected and your clients keep them permanently. You lose the right to begin new engagements with the toolkit, and you stop receiving updates.
Do you take referral commission?
No, and we do not want you to route your clients to us. The commercial relationship is between you and your client. We sell you an input.
Can I resell the toolkit itself?
No licence permits republishing the documents as a template set, toolkit or documentation product, free or paid, under any brand. The line is between delivering an implementation to a client, which the Practitioner and Practice Licences permit, and republishing the toolkit as a product, which nothing permits.
Not sure which licence you need?
Tell us how many people deliver ISO 42001 work in your organisation and roughly how many engagements a year, and we will tell you which licence fits — including telling you that a one-time tier is enough, if it is.