Manage your artificial intelligence in an ethical, transparent, and compliant manner. We offer agile, straightforward, and customized support, regardless of your industry, company size, or level of maturity. We adapt our approach to your specific situation—not the other way around.
.webp)
+ Over 200 companies have already placed their trust in us
ISO/IEC 42001 is the first certifiable international standard dedicated to artificial intelligence management systems. Published in December 2023, it defines the requirements for establishing, implementing, maintaining, and continuously improving a responsible and well-managed AI Management System (AIMS).
Built on the High-Level Structure (HLS) common to other ISO standards, it consists of 10 chapters and Annex A, which contains specific controls covering the entire lifecycle of AI systems: data, models, deployment, monitoring, and third-party relationships.
It covers 80 to 85% of the requirements of the European AI Act, making it the best operational foundation for addressing your regulatory obligations and reassuring customers, investors, and authorities about your use of AI.
AI is everywhere in your organization, but governance is struggling to keep up. Here are the risks you face if you don’t structure your approach.
Up to €35 million or 7% of global revenue in the event of non-compliance involving high-risk AI. The rules will be phased in through 2027: establishing a governance framework now can help you avoid penalties later.
Your models reproduce or exacerbate discrimination without anyone realizing it. Without a review process, the legal, ethical, and reputational risks are constant.
Your customers, partners, and regulators want to understand why your AI systems make certain decisions. Without documented traceability, you can’t provide an answer—and you’ll lose business.
Quality, provenance, bias, usage rights: the data that powers your models is a blind spot. ISO 42001 requires documented rigor throughout the entire data lifecycle.
You integrate ChatGPT, Claude, Gemini, or other large language models (LLMs) into your products, but their governance practices are beyond your control. The standard requires a structured assessment of these third parties.
A system that performs well at launch can gradually deteriorate if left unmonitored. ISO 42001 requires continuous monitoring to protect your users and preserve the value of your systems.
Our agile approach turns these challenges into manageable steps. A dedicated project manager guides you through each milestone, simply and efficiently.
Talk to an expert →Whether you’re an AI startup, a SaaS provider integrating large language models (LLMs), or a mid-sized company deploying AI in its business processes, we offer a solution tailored to your organization.
Take control of your certification. At your own pace.
Access our GRC platform and a comprehensive ISO 42001 playbook to independently structure your occupational health and safety management system. The tool provides the framework; you stay in control.
An expert by your side. No blind spots.
Take advantage of a structured support program that combines consulting, training, and auditing to help you move faster, avoid critical mistakes, and feel confident on the day of your certification audit.
Leave it all to us. Get your certification.
We manage every aspect of your ISO 42001 project: from the initial scoping to obtaining your certificate. Your team can stay focused on its core business.
Each step is clearly defined, documented, and monitored using specific metrics. You always know where you stand.
Mapping of your AI systems (in-house and third-party), maturity assessment, definition of the SMIA scope, and a customized AI Act-ready roadmap.
AI Impact Assessment (AIIA), AI policy, governance and roles, implementation of controls (Appendix A), model lifecycle framework, team training.
Mock certification audit, review of AI use cases, resolution of non-conformities, management review, and preparation of teams for the meeting with the auditor.
Support during both phases of the audit (documentary and on-site) conducted by the accredited certification body.
In addition to ISO 42001, we cover all information security certifications
Here’s what those who have experienced the program firsthand have to say.
"
We had very good support. Our quality system was very well studied by the project manager, which made the whole project easier."

Stefano FIORENTINI - CTO
"
Feel Agile has great process knowledge, a project plan with an efficient tempo and existing documentation material to save time."
.webp)
Mickaël KLAUS
"
Thanks to Feel Agile, we were able to obtain ISO 27001 certification without a single non-conformity, which is a rare achievement."

Julien Cassagnabère -RSSI
All you need to know about ISO 42001
ISO 42001 is intended for any organization that develops, provides, or uses AI systems, regardless of its size or industry: SaaS providers integrating large language models (LLMs), AI startups, digital services firms deploying AI for their clients, companies using AI tools internally (recruitment, scoring, support, fraud detection), and organizations in the healthcare, finance, or public sectors. It is particularly relevant for organizations subject to the AI Act or operating in regulated sectors.
The AI Act is a binding European regulation that took effect in August 2024 and will be phased in through 2027. It imposes strict requirements, particularly for high-risk AI systems, with penalties of up to €35 million or 7% of global revenue.ISO 42001 is a voluntary, certifiable international standard that provides a management framework for governing AI. It covers 80 to 85% of the AI Act’s requirements: it is currently the best operational foundation for achieving compliance in a structured manner, even before the publication of harmonized European standards.
ISO 42001 certification can be broken down into different phases (the estimates are based on a company with about 20 employees and products or an organization of relatively low complexity.)
The cost of the certification itself (certification body): Over each 3-year period, the cost of the certifier’s various services (initial, surveillance, and renewal audits) is €1 to €1. (As a reminder, the cycle for any ISO certification is 3 years.)
The cost associated with time spent on implementation:This refers to the hourly cost of staff temporarily dedicated to implementing the OHSMS. During the critical phases at the start of the project (2 months) and at the end of the project (2 months), the work involved in building skills amounts to between 1 and 2 person-days per week. During the project monitoring and coordination phases, the project manager’s workload is 1 person-day per week. You can choose to be less directly involved by delegating a large portion of the work to the consultant. With a consultant who acts as project manager and provides consulting/training.
Cost of ISO 42001 consulting and training: The costof ISO 42001 certification naturally varies depending on the size of the company: it may double for a company with 150 employees compared to an SME with 10 employees. It also varies depending on the scope selected and the tasks assigned to the consultant (training, consulting, mock audit, formalization of procedures). This cost can range from €25,000 to €45,000. On average, it is around €30,000. If you are already ISO 27001 certified, synergies significantly reduce the effort required, amounting to approximately 2.2 times the cost of a single certification process for both standards combined.
The time required to prepare for ISO 42001 certification varies depending on your starting point, but it generally ranges from 6 to 18 months.
There is no one-size-fits-all timeline: it all depends on your current OSH maturity, your organizational structure, and the resources you can mobilize internally.
This is precisely why tailored support makes all the difference.
The main factors influencing the timeline:
- Your AI maturity: have you already documented your AI systems, defined governance policies, and identified your algorithmic risks?
- Your existing certifications: an organization already certified to ISO 27001 has a solid foundation (ISMS, risk management, internal audit) that significantly accelerates the implementation of the AIMS
- The size of your organization: the broader the scope, the longer the scoping and documentation phase
- Available internal resources: a dedicated AI lead greatly accelerates evidence collection and compliance
The AI Management System ( AIMS ) is the core framework required by ISO 42001. It encompasses the policies, roles, processes, metrics, and tools needed to govern AI responsibly throughout its entire lifecycle: design, data, training, deployment, monitoring, and decommissioning. It addresses ethical requirements (fairness, transparency), technical requirements (robustness, security), and organizational requirements (roles, training, supplier relationships).
No. ISO 42001 certification is valid for three years, with mandatory annual surveillance audits. At the end of the three-year period, a renewal audit is conducted. This cycle ensures continuous improvement and maintains the value of the certification over time. FeelAgile offers ongoing support to help you prepare for each milestone with confidence.
Yes, absolutely. ISO 42001 identifies three roles: developer, provider, and user of AI systems, and all of them are affected. If you integrate third-party LLMs (OpenAI, Anthropic, Google, etc.) into your products or internal processes, you are an AI user as defined by the standard and the AI Act. You must then assess the risks associated with these systems, document their uses, train your teams, and establish contractual agreements with your suppliers. The standard sets out specific requirements regarding relationships with third-party AI providers.
This is a huge advantage. Both standards share the HLS structure (10 common chapters) and the PDCA cycle. Section 8.8 of ISO 42001, which addresses AI security, draws directly on the controls inAnnex A of ISO 27001. Many processes can be shared: incident management, risk management, internal audits, and management review. We are building an integrated system that avoids redundancies—and for the most mature organizations, triple compliance with ISO 42001 + ISO 27001 + GDPR is the optimal approach.
A mock audit helps prepare for the certification body’s audit.
This audit serves as a practice run conducted under similar conditions, allowing the company to assess, through hands-on experience, its level of preparedness in terms of information security.
Obtaining ISO 42001 certification is a clear goal for any company committed to this process of continuous improvement in information security.
During the mock audit, the auditor’s external perspective takes an uncompromising look at the critical issues. On this occasion, teams are prepared for potential requests from the certifying body. This examination, conducted in a real-world setting but without penalties, allows for the verification of the effective implementation of the ISMS, the identification of any shortcomings, and the assurance of a smooth certification audit process.
Depending on the scope of the ISO standard and the type of company, it can be completed in 2 to 5 days. Additionally, this audit partially fulfills the internal audit requirements of ISO 42001. We conduct audits of your SMIA on your behalf.
The key is to choose a certification body accredited by COFRAC (the French Accreditation Committee).
This accreditation guarantees the certifier’s competence to assess your ISO 27001 implementation.
In addition, other criteria are important:
- the certifier’s experience with the ISO 42000 family of standards
- the certifier’s reputation within your market (France? International?)
- the ability to handle multiple certifications, whether you are pursuing ISO 27001 or another standard.
Finally, it is essential to choose a certification body that truly listens to your needs and is willing to take your choices into account (scope of application, selected measures, corporate culture…), rather than imposing a rigid framework ill-suited to your specific situation.
The certification body must listen, but cannot assist you in your process. It cannot be both judge and jury.
ISO 42001 certification is now a rare competitive advantage: only about 2,400 organizations worldwide are certified. In practical terms, it helps you win bids —62% of B2B tenders by 2025 will require documented AI governance. It reassures your key account clients and those in regulated sectors (finance, healthcare, public sector). It anticipates the AI Act and reduces your exposure to penalties. Finally, it streamlines your governance framework: your data, product, and legal teams gain a shared framework, which accelerates your AI projects rather than slowing them down.
ISO 42001 consulting is a demanding process. To maintain your momentum and achieve certification efficiently, it is essential to engage an experienced consultant.
The consultant you hire will leverage their expertise to:
- Explain and advise you through every stage of implementing the SMIA
- Train teams with a pragmatic approach to AI governance
- Provide proven document templates that can be adapted to your context
- Formalize the deliverables required by the standard (AI policy, risk register, monitoring procedures)
- Prepare for the certification audit through simulations and a mock audit. Integrate the AIMS into your organization for sustainable adoption of ISO 42001
The assistance of a consultant is therefore a guarantee of success in building an AI management system that is useful, pragmatic, and truly tailored to your reality.
Want to go further with our articles on ISO 42001?
Do you have any questions? Would you like a quote for certification or support?