Our AI Vendor Says They're ISO 42001 Certified — Does That Cover Us?

Detailed Explanation

A vendor mentioning ISO 42001 certification in a sales conversation, a security questionnaire response, or their marketing material is meant to reassure you. Often it should — but the reassurance only extends as far as the certificate's actual scope, and that scope is rarely as broad as the mention implies.

This is not a hypothetical concern. Large cloud and AI vendors have published ISO 42001 certifications that name specific services rather than the whole company: a certification might cover a defined set of AI products or a particular business unit, while adjacent products, older versions, or features added after the audit sit outside it entirely. A vendor is not being dishonest by saying "we're ISO 42001 certified" while meaning "one part of what we sell is" — but the difference matters a great deal if you're the one relying on that certification to answer your own customer's question.

What the Certificate Actually Certifies

ISO 42001 certifies that an organisation operates a management system for identifying, assessing, and managing risks associated with AI — documented processes for AI risk assessment, oversight, and continual improvement. It does not certify:

• That a specific AI model will produce accurate or unbiased outputs on any given task.
• That every product or feature the vendor sells is covered, unless the scope statement says so explicitly.
• That the vendor's certification is permanent — certifications require ongoing surveillance audits and can lapse or be withdrawn.

Confusing "the vendor holds a management-system certification" with "this specific product is guaranteed safe" is the single most common misreading of a vendor's ISO 42001 claim.

How to Actually Check the Scope

1. Request the certificate and scope statement directly. A genuine certificate names the certified organisation, the standard, the certifying body, and — critically — a scope statement listing exactly which products, services, or sites are included. If a vendor can only offer a general statement of commitment rather than this document, the certification claim needs more scrutiny, not less.
2. Match the scope to what you actually use. If the scope names three specific AI products and you use a fourth, the certification tells you nothing directly about the product you're relying on. Ask the vendor explicitly whether the product you use is covered, and get the answer in writing.
3. Check the certifying body's accreditation. Under ISO/IEC 42006:2025, which sets requirements for bodies certifying organisations to ISO 42001, a credible certificate should trace back to a certifier accredited by a recognised national accreditation body — JAS-ANZ in Australia, or an equivalent body such as UKAS or ANAB elsewhere. A certificate from an unaccredited or self-declared "certifier" is a much weaker signal.
4. Note the certification date and check it's current. Certifications are audited on a cycle, typically with annual surveillance audits. A certificate issued two or three years ago without evidence of a recent surveillance audit may no longer reflect current practice.

Why This Matters for Your Own Answer

If you're asked — by a customer, an auditor, or in a tender — whether the AI tools you use are appropriately governed, citing "our vendor is ISO 42001 certified" without having checked the scope risks passing along a claim you haven't actually verified. That's a weaker position than checking the scope once and being able to say precisely what it does and doesn't cover.

It also doesn't remove your own obligation to have evidence of how you govern your use of the tool. A vendor's certificate, even a well-scoped one, only covers the vendor's side of the relationship — what you did with the tool, who reviewed its output, and how you use it inside your own business is still something only your own records can demonstrate. See what evidence do you actually need to show you're governing AI for what that looks like on your side.

Things to Consider

• A narrow scope isn't necessarily a red flag. Certifying a specific, well-defined product line is a reasonable and common approach — the issue is only when a vendor lets a narrow certification imply company-wide coverage without correcting the impression.
• Ask the same scope question about any other framework a vendor cites, not just ISO 42001 — SOC 2 reports and ISO 27001 certifications have the same scope-statement structure and the same risk of being read as broader than they are. See what SOC 2 and ISO 27001 actually mean when choosing an AI vendor for the equivalent check on those.
• A certification is a point-in-time claim about a management system, not a live guarantee. Treat it as one input into vendor due diligence alongside the vendor's data processing agreement, not as a standalone answer. See how do you evaluate an AI vendor's data processing agreement for the rest of that assessment.
• If your own business is weighing certification, the scope question applies to you too. See do you need ISO 42001 certification, or just to prove you govern AI for whether certifying your own business is worth it, and what a well-scoped certification of your own would need to cover.

Common Mistakes

• Repeating a vendor's certification claim to a customer without having seen the scope statement. This passes along an unverified claim as if it were checked, and it can come back on you if the customer later asks a follow-up question you can't answer.
• Assuming "ISO 42001 certified" means every product the vendor sells is covered. Large vendors in particular are likely to certify a defined subset of their offering first, with other products following later or not at all.
• Treating the certificate as proof the AI model itself won't make mistakes. ISO 42001 certifies the management system around AI risk, not the correctness of any individual model output — you still need your own review and evidence practices regardless of what the vendor holds.
• Not checking whether the certifying body is accredited. Not every organisation issuing an "ISO 42001 certificate" has been through an accredited certification process — verifying the certifier's own accreditation is a five-minute check that avoids relying on a weaker claim than it appears to be.