ISO 42001 Certified AI: Who Actually Is — And What Else Matters?

Very few AI vendors today are actually ISO 42001 certified, and amaiko isn’t one of them: we’re aligned with ISO 42001, but not certified. That’s stated this plainly because the market systematically blurs the distinction — and because you can verify it for any vendor yourself, in two minutes.

What you’ll take away from this article:

• ISO/IEC 42001:2023 is the first international standard for AI management systems, published in December 2023.
• A certificate is issued exclusively by an accredited certification body — never by the vendor itself.
• Three terms, three different claims: certified, aligned, ready.
• Verification takes two minutes: certificate number, certification body, scope.
• For the mid-market, something else usually decides: where the data is processed and what the data processing agreement says.

What is ISO 42001 — and what does “certified” actually mean?

ISO/IEC 42001:2023 sets the requirements for an AI management system: how an organization captures AI risks, assigns responsibilities, documents decisions, and continuously improves all of it. It was published in December 2023 by the joint committee ISO/IEC JTC 1/SC 42.

Important: the standard describes a management system, not a product feature. It says nothing about how good a model’s answers are — only about whether the vendor operates its AI in a controlled way.

“Certified” means: an independent, accredited certification body has audited the management system and issued a certificate with a number, scope, and validity period. In Germany, the DAkkS — Germany’s national accreditation body — accredits these bodies. A self-declaration is not a certification, no matter how convincingly it’s worded.

How do you verify whether an AI vendor is really certified?

Three questions, and you’ll know. Ask them in writing, and you’ll have the answer for your procurement file too:

1. “What’s the certificate number, and which body issued it?” A genuine certificate has both. Anyone who points to a marketing page instead doesn’t have one.
2. “Is that body itself accredited — and by whom?” Certification bodies need their own accreditation, in Germany through the DAkkS. Without accreditation, the paper is an opinion.
3. “What’s the scope?” The question that most often uncovers something. A certificate can apply to a single subsidiary, one data center, or a single product — and not to what you’re actually buying.

If any of these three answers is missing, there’s no certification. That’s not a disqualifier — but it belongs in your documentation, accurately stated.

What’s the difference between “certified”, “aligned”, and “ready”?

This is where the market blurs the most, so in plain terms:

• Certified — audited and confirmed by an accredited body, verifiable via the certificate number.
• Aligned — the management system is built to the standard’s requirements, but without external audit. Verifiable through documentation and processes, just without a certificate.
• Ready — the vendor considers itself capable of being certified. A statement of intent, not proof.

All three can be legitimate. Only the first is a certificate, and only it may be called one.

Where does amaiko stand?

amaiko is aligned with ISO 42001, not certified. There’s no certificate number and no accredited body we could point to. If you need a line for your compliance documentation: “aligned with ISO 42001, not certified.” Exactly that.

What we can prove is the processing: amaiko runs its own infrastructure in Germany — the data doesn’t sit in the Microsoft cloud, but on our own, separate infrastructure. amaiko is GDPR-compliant and aligned with the EU AI Act (Regulation (EU) 2024/1689). Details on the Security page.

Criterion	What it means	Evidence
ISO 42001 certified	Passed external audit	Certificate number + accredited body
ISO 42001 aligned	Management system built to the standard	Documentation, processes
ISO 42001 ready	Self-assessment	None
GDPR compliance	Lawful processing	Data processing agreement, TOMs, records of processing
Processing location	Which jurisdiction can access it	Contract + data center disclosure

What matters more than a certificate for the mid-market?

Uncomfortable, but true: a certificate doesn’t answer the question your works council asks. That question isn’t “which standard?” — it’s “who can access our data?”

Three things carry more weight in practice.

Where processing happens. Not where the data rests, but where the tokens are actually computed. A US vendor with a European data center is still a US vendor — a jurisdiction question no certificate resolves. We broke this down in GDPR-compliant AI in Microsoft Teams.

The data processing agreement. Processing terms, subprocessors, deletion periods, right to instruct. The document that actually counts in a dispute — and more concrete than any standard.

Whether the system actually gets used. A perfectly certified AI nobody opens is a compliance line item, not a tool. That’s exactly where most rollouts fail, as shown in why employees ignore Copilot.

Want to verify where your data is really processed — with a contract instead of a seal? Book a free live demo now.

Frequently Asked Questions (FAQ)

Is amaiko ISO 42001 certified?

No. amaiko is aligned with ISO 42001 but holds no certification against the standard — no certificate number, no accredited certification body. For internal compliance documentation, the accurate wording is: “aligned with ISO 42001, not certified.”

How can I tell if an AI vendor is really ISO 42001 certified?

Ask for the certificate number, the issuing certification body, and the scope. All three exist for a genuine certificate. Also check whether the body itself is accredited — in Germany, by the DAkkS, Germany’s national accreditation body. If any of the three answers is missing, there is no certification.

What’s the difference between “ISO 42001 certified” and “ISO 42001 aligned”?

Certified means an independent, accredited body has audited and confirmed the AI management system. Aligned means the vendor has built its management system to the standard’s requirements, without external audit. Both can be legitimate, but only the first is a certificate.

Do I need ISO 42001 certification for the EU AI Act?

No. Regulation (EU) 2024/1689 does not require ISO certification. A management system built to ISO 42001 helps meet the documentation and governance requirements in a structured way, but it isn’t a legally mandated proof.

What actually is ISO/IEC 42001?

ISO/IEC 42001:2023 is the first international standard for AI management systems, published in December 2023. It defines how an organization captures AI risks, assigns responsibilities, and documents decisions. It describes a management system, not a product feature — it says nothing about the quality of a model’s answers.

What should I check instead of a certificate?

Where processing actually happens — meaning where the tokens are computed, not just where the data rests —, the data processing agreement with subprocessors and deletion periods, and whether the system is actually used day to day. A certificate answers none of these three questions.

What does amaiko cost?

amaiko costs €29.91 per user per month billed annually (€37.39 billed monthly). For strict data requirements, there’s amaiko liberté at €44.87 per user per month: exclusively Mistral models, every token processed in the EU.