Is ISO 42001 Mandatory?

The direct answer

ISO/IEC 42001:2023 is a voluntary international standard published by ISO and IEC in December 2023. No law anywhere currently mandates ISO 42001 certification. You cannot be fined or prosecuted for not being certified.

This matters because some marketing tries to suggest certification is mandatory. It isn't, but the incentive landscape makes it behave like it is for many organisations.

When ISO 42001 is effectively required

1. You're a Microsoft supplier processing personal/confidential data or providing AI services

Microsoft's SSPA DPR v12 explicitly accepts ISO 42001 certification in lieu of independent assessment for AI requirements. Without certification, you complete Microsoft's assessment (significant effort). With certification, you submit the cert and skip most of it. Many suppliers will pursue certification simply to reduce SSPA friction.

2. You deploy high-risk AI systems in Colorado

Colorado's original AI Act (SB 24-205), which offered an affirmative defense to organisations aligned with ISO 42001 or NIST AI RMF, was repealed in May 2026 and replaced by SB 189, a narrower transparency law effective 1 January 2027. ISO 42001 is no longer a statutory Colorado affirmative defense, but it remains strong evidence of AI governance for procurement, the EU AI Act, and SB 189's documentation expectations.

3. Your enterprise customers ask for it

Fortune 500 procurement teams are starting to require ISO 42001 alignment from AI vendors. If you sell AI to large enterprises, expect to see it in RFPs throughout 2026.

4. You're placing high-risk AI on the EU market

The EU AI Act requires conformity assessments for high-risk AI systems. ISO 42001 is not (yet) a formally harmonised standard under the AI Act, but it produces the majority of evidence you'll need for Article 17 (QMS), Article 9 (risk management), and other articles. Without it, you're building the QMS from scratch.

5. You're an AI-first company signalling to investors, insurers, or acquirers

Due diligence increasingly asks about AI governance. Certification is the fastest credible answer.

When you probably don't need ISO 42001

• You don't use or build AI systems (obvious but worth stating).
• Your AI use is incidental, for example, you use ChatGPT occasionally for internal productivity but AI isn't in any customer-facing product or consequential decision.
• You're pre-revenue, pre-product, certify later when you have evidence of operation to audit.
• You're in a sector where no customer, regulator, or partner is asking about AI governance.

Even then, documented AI governance practice (the AIMS without certification) is still a reasonable investment, the documentation and governance value stands on its own, independent of formal certification.

The middle path, implement without certifying

Many organisations implement the AIMS according to ISO 42001 but do not pursue formal certification. They still get:

• Enterprise procurement & US state AI laws (e.g., Colorado SB 189)
• Most of the EU AI Act evidence
• An internal governance framework
• Credible answers to customer AI-governance questions

What they don't get: the certificate itself. If customers or Microsoft SSPA won't accept "we're aligned", then certification is the next step. If "we're aligned" is sufficient, the middle path is often the most efficient.

The Starter tier at $199 is explicitly positioned for this middle path, it gives you the documentation to implement alignment without forcing the certification decision.

Decision framework