How to choose an ISO/IEC 42001 certification body in the US

This page is a buying guide for the certification body. It is for operations, quality, IT, and compliance leads at mid-market manufacturers and professional-services firms who already know the artifact this cycle is an ISO/IEC 42001 certificate, and who now have to pick the body that can issue it in the United States.

The useful question is narrow. Which legal entity is accredited for ISO/IEC 42001:2023, under a mark your customer will accept, with people who can sample the AI systems you actually run. A familiar logo, a 27001 relationship, and a slide that says "AI" are three different facts.

If the room is still choosing the artifact, stop here and settle that first. Information security versus an AI management system is ISO 27001 vs ISO 42001. Quality versus an AI management system is ISO 9001 vs ISO 42001. A NIST AI Risk Management Framework profile versus the certificate is ISO 42001 vs NIST AI RMF. This page starts after that sentence is written.

It does not publish prices, audit durations, or customer counts. It does not rank firms. The comparison table below uses only what each profile in this directory already states about a published accreditation scope. Confirm the live schedule in the quarter you would book.

1. What you are buying, and what ISO/IEC 42006 is

ISO's certification page states that ISO develops standards and does not perform certification or issue certificates. Certification is an independent body giving written assurance that a system meets specified requirements. Accreditation is a further body recognizing that the certification body operates to international standards.

The standard your organization would be certified to is ISO/IEC 42001:2023. ISO's catalogue entry describes requirements for establishing, implementing, maintaining, and continually improving an AI management system, for organizations developing, providing, or using AI. The certificate records that a certification body examined that system for a defined scope. It does not approve a model, a product, or a law.

ISO/IEC 42006:2025 is a different document. ISO's catalogue entry titles it "Information technology, Artificial intelligence, Requirements for bodies providing audit and certification of artificial intelligence management systems." The page records status Published, edition 1, publication date 2025-07, and stage 60.60 (international standard published on 2025-07-07). ISO's own questions on that page say three things a buyer can use:

• ISO/IEC 42006 sets out additional requirements for bodies that audit and certify an artificial intelligence management system (AIMS) according to ISO/IEC 42001. It builds on ISO/IEC 17021-1.
• It does not replace ISO/IEC 17021-1. It supplements that standard with AI-specific requirements for auditing and certification.
• The users ISO names are certification bodies performing audits of AI management systems based on ISO/IEC 42001, and accreditation bodies assessing those certifiers.

Your plant or your practice does not "get ISO/IEC 42006." Ask whether the accreditation behind the body you are about to hire was assessed against those additional requirements. Then read the schedule for ISO/IEC 42001:2023. A training course about 42006 is not an accreditation. A product claim about one model is not an AIMS certificate.

2. Why the accreditation mark is a 42001 question

Management-system certification bodies are assessed against ISO/IEC 17021-1. That is the general standard. ISO/IEC 42006 adds requirements for the specific job of auditing an AIMS. A body can be accredited for ISO 9001, ISO/IEC 27001, or both, and still have no accredited scope for ISO/IEC 42001. Copying last year's shortlist is how a 42001 request goes to a body that cannot sign it. The companion page for the information-security certificate is how to choose an ISO/IEC 27001 certification body in the US.

ANAB (ANSI National Accreditation Board) is the accreditation body US buyers usually meet on a management-system certificate. ANAB's ISO/IEC 42001 program page lists these documents for that program: Accreditation Rule 59, ISO/IEC 42001:2023, and ISO/IEC 42006:2025. The same page points certification bodies to ANAB's process for ISO/IEC 17021-1 management-systems accreditation. ANAB describes 42001 as a model for an AIMS whose design depends on the organization's role, including producer, developer or provider, and user.

ANAB's explanation of ISO/IEC 42006:2025 (30 September 2026) says certification bodies demonstrate competence for AIMS audits through accreditation using the criteria in ISO/IEC 17021-1 and ISO/IEC 42006:2025, and that ANAB's 42001 program evaluates competence against those requirements. This page does not reprint transition dates from an older issue of Accreditation Rule 59. Read the rule ANAB links from the program page before you treat a 2024 announcement as the rule that applies this quarter.

Other IAF MLA accreditation bodies can be the right mark when the customer named that mark. The IAF MLA member list dated 1 August 2025 records ANAB and UKAS as signatories for management-systems certification, Level 3 document ISO/IEC 17021-1. For ANAB, the sub-scopes on that list include ISO 9001 (quality) and ISO/IEC 27001 (information security), among others. For UKAS, the same pattern appears: ISO 9001 and ISO/IEC 27001 are named sub-scopes. The list does not name ISO/IEC 42001 or ISO/IEC 42006 anywhere.

IAF's MLA status table shows the same structure. Management-system certification sits on ISO/IEC 17021-1:2015. The Level 5 standards named there include ISO 9001:2015, ISO/IEC 27001:2022, and ISO 45001:2018. They do not include ISO/IEC 42001 or ISO/IEC 42006.

Read that limit in plain terms. An IAF MLA signatory is the class of accreditation body this buy should use. Peer evaluation is why an ANAB mark and a UKAS mark are often treated as the same kind of accreditation on a questionnaire. The August 2025 member list does not make ISO/IEC 42001 an endorsed MLA sub-scope. A 9001 sub-scope does not cover an AIMS. A 27001 sub-scope does not cover an AIMS. UKAS can still print ISO/IEC 42001 on a certification body's own schedule. That line is the schedule. It is not a row in the MLA sub-scope list. The lookup method for any of these marks is how to verify an ISO registrar's accreditation.

If a customer portal says "ANAB only" or "UKAS only," write that constraint before you invite anyone. Equivalence between MLA signatories is real. A portal checkbox is a separate fact.

3. How to verify a certification body's 42001 scope

Use the verify guide and add the 42001 specifics. The steps are the same shape as any other standard. The failure mode is inference.

1. Ask, in writing, for the legal entity that will sign the certificate, the accreditation body, and the edition ISO/IEC 42001:2023.
2. Open that accreditation body's directory and read the current schedule for that legal name. ANAB's management-systems directory is the usual US start. UKAS find-an-organisation is the check when the proposal says UKAS. IAF CertSearch is where you trace accredited certificates and certification-body identities. Use both the accreditation-body directory and CertSearch. A brand search is not either one.
3. Read the 42001 line itself. Some schedules print roles (developer, producer, provider, user). Some do not. Ask which roles the audit will cover when the schedule is silent, and ask whether your work matches the roles when the schedule prints them.
4. Refuse the shortcuts. A 27001 line does not include 42001. A 9001 line does not include 42001. A group brochure, a press release, and a sister company's schedule do not include it. The US company and the UK company inside one brand can hold different scopes. Match the entity on the proposal to the entity on the schedule.
5. Re-check before Stage 1, in the quarter you would book. AIMS accreditation is newer than 9001. A schedule you saved at shortlist time can move.

The directory on this site is an editorial shortlist. A profile is a reading of public scopes at the time it was written. It is not the live schedule.

4. Profiles in this directory that state 42001 on a published scope

The table includes a certification body only when its profile in this directory states that ISO/IEC 42001 is on a published accreditation scope, or, for Schellman, states ANAB accreditation for ISO/IEC 42001 from a public announcement and tells you to confirm the current scope. Cells repeat the profile. They do not add a later lookup, a price, or a ranking.

Certification body	Accreditor and 42001 scope, as the profile states it	27001, 27701, and 9001 on that scope
A-LIGN	ANAB's public scope for A-LIGN Compliance and Security, Inc. dba A-LIGN lists ISO/IEC 42001:2023. The UKAS schedule for the same entity lists ISO/IEC 27001:2022 and ISO/IEC 27701, and does not list ISO/IEC 42001.	ANAB lists ISO/IEC 27001, including the 2022 edition, and ISO/IEC 27701. UKAS lists ISO/IEC 27001:2022 and ISO/IEC 27701:2019. ANAB records a voluntary withdrawal of ISO 9001 in November 2020. The current ANAB scope does not list ISO 9001.
Coalfire	The ANAB scope for Coalfire Certification, Inc., accreditation ID MS-4539, issue date 13 August 2026, lists ISO/IEC 42001:2023. Initial accreditation and the 2023 edition are both dated 17 June 2025. This profile did not match a UKAS schedule to this legal entity.	The same issue lists ISO/IEC 27001:2022 and ISO/IEC 27701 (2019 and 2025). ISO 9001:2015 is on the issue for information technology, economic sector 33, under ANAB Accreditation Rule 20. ISO 14001 and ISO 45001 are absent.
Insight Assurance	The IAS scope for Insight Assurance, accreditation ID MSCB-306, effective date 9 October 2026, lists ISO/IEC 42001:2023. The additional level 4 standard on that line is ISO/IEC 42006:2025. The scope does not print the roles developer, producer, provider, and user. The IAS certificate page lists status Accredited and expiry 1 December 2026. This profile did not match an ANAB or UKAS schedule to this name.	The same scope lists ISO/IEC 27001:2022 and ISO/IEC 27701:2019 and ISO/IEC 27701:2025. Certification sectors are N/A. ISO 9001, ISO 14001, and ISO 45001 are absent.
NQA	The published UKAS schedule for NQA Certification Ltd lists ISO/IEC 42001:2023, including the roles developer, producer, provider, and user. ANAB's published scope for National Quality Assurance, USA, in Acton, Massachusetts, dated 26 March 2026, does not list ISO/IEC 42001. NQA's U.S. regulations say the U.S. company issues ANAB certificates under its own scope and issues UKAS certificates on behalf of NQA Certification Limited.	Both published scopes list ISO/IEC 27001:2022 and ISO 9001:2015. ISO/IEC 27701 appears on both. The UKAS schedule and the ANAB scope also list ISO 14001:2015 and ISO 45001:2018.
Schellman	Schellman Compliance LLC publicly announced ANAB accreditation for ISO/IEC 42001 in September 2024. The profile says Schellman is widely cited as the first ANAB-accredited AIMS certification body, and it says to confirm the current ANAB scope. It does not quote a schedule issue date.	The profile calls Schellman a known ISO/IEC 27001 certification body and says to confirm the current ANAB scope. It does not state an ISO/IEC 27701 line. It says Schellman is not listed here as a general ISO 9001, ISO 14001, or ISO 45001 factory registrar.
TÜV Rheinland of North America	ANAB's scope for TUV Rheinland of North America, Inc., issued 9 February 2026, lists ISO/IEC 42001:2023. The 42001 line is dated 4 September 2025. The scope does not print the roles developer, producer, provider, and user. This profile did not match a UKAS schedule to that legal entity.	The same scope lists ISO 9001:2015, ISO/IEC 27001:2013, ISO/IEC 27001:2022, and ISO/IEC 27701:2019. It also lists ISO 14001:2015 and ISO 45001:2018.

NQA is the split to read twice. The UKAS schedule lists ISO/IEC 42001. The ANAB scope for the Acton company does not. If the customer wants an ANAB mark on the AI management certificate, the profile does not give you that line. If the customer accepts a UKAS mark, ask which legal entity grants the certificate. The profile says NQA UK retains responsibility for granting, issuing, and withdrawing those UKAS certificates.

A-LIGN has the same shape on a smaller scale. The ANAB scope lists ISO/IEC 42001:2023. The UKAS schedule the profile cites does not. A UKAS information-security mark is not a UKAS AI-management mark.

Coalfire's quality line is information technology. Sector 33 is not a plant code. A manufacturer that needs ISO 9001 for fabrication, and ISO/IEC 42001 for a vision cell, should not treat that 9001 line as the factory certificate.

Insight Assurance's mark is IAS. The published scope MSCB-306, effective 9 October 2026, lists ISO/IEC 42001:2023 for Insight Assurance in Tampa, and the IAS certificate page lists expiry 1 December 2026. The same scope lists ISO/IEC 27001:2022 and both ISO/IEC 27701 editions. It does not list ISO 9001. The profile did not match an ANAB schedule to this name. A portal that accepts only ANAB does not get that mark from this row.

TÜV Rheinland of North America is the general management-system registrar in this table whose ANAB scope, as the profile states it, lists 9001, 14001, 45001, 27001, 27701, and 42001 for TUV Rheinland of North America, Inc. The profile did not match a UKAS schedule to that entity. Ask which AI roles the audit will cover. The scope does not print them.

Schellman is in the table because the profile states ANAB accreditation for ISO/IEC 42001, from a September 2024 announcement, and tells you to confirm the current scope. It is a specialist entry. The profile does not present Schellman as the factory registrar for ISO 9001.

The other profiles in this directory are not rows. Amtivo and Eagle say ISO/IEC 42001 is absent from the scope they reviewed. Bureau Veritas, NSF, Perry Johnson Registrars, and TÜV SÜD tell you not to assume 42001 coverage. BSI, DEKRA, DNV, Intertek, LRQA, and SGS record a public announcement or a public association with an accreditation body and tell you to confirm the live schedule. An announcement is a reason to open the profile. It is not a statement that a published scope lists the standard. Read that profile, then verify the legal entity.

5. How to choose among bodies that can actually sign

Accreditation is the gate. It is not the whole award. Four practical tests separate a body you can hire from a body that merely cleared the scope check.

Auditor competence for the AI you run. ISO's 42006 page says the additional requirements exist so certification bodies have the competence to assess organizations developing, deploying, or offering AI systems. Ask for that competence in your words. On a plant, the sample is often a vision cell, a scheduling or maintenance model, or a generative tool a process engineer uses to draft a procedure. In a professional-services firm, the sample is the model inside delivery: analysis, a recommendation, a draft, or code a client will receive. A lead auditor who can sample an information-security management system still has to show they can sample approval, monitoring, and retirement of those systems. Ask for anonymized examples of similar AIMS audits: the role (developer, provider, user), the kind of system, and the sector. A name on a 27001 certificate is not that example.

Integration with an existing 27001 or 9001 audit. One programme is an honest request when both systems already run, both owners can sit the audit, and the same legal entity's scope covers each standard you want on the certificate. You may still receive two certificates. Say which processes are shared and which evidence is standard-specific. Information-security controls and AI impact records are different objects until you show they are the same file. A quality process and a model that accepts or rejects parts can share a visit only when someone can walk both.

A second certification body is a clean design when the scopes diverge. The table above is full of that pattern. A specialist whose ANAB scope lists 42001 and 27001, and whose profile does not list factory 9001, can hold the AIMS while the plant registrar keeps 9001. A plant registrar whose ANAB scope lists both 9001 and 42001 can hold both when the quality sector on that scope matches the work. Write the design on purpose. "Quote everything and we will see" produces unlike replies.

Scope definition. The certificate boundary is the systems you will claim, the sites where they are approved and run, and the legal entity that owns the system. Pilots you will not defend stay out, with a reason. Personal tools stay out. A chatbot someone tried once is not an AIMS. Name the edition, ISO/IEC 42001:2023. Name what is out as clearly as what is in. The outbound page for that description is the RFQ / scope pack. Send the same page to every body you might award.

Multi-site. The 9001 site list is often the wrong map. Information and AI work sit at headquarters, a development office, a lab, or a cloud estate the factory certificate never named. Name the central function: the place that owns the AI policy, the impact records, and the authority to make other locations follow the same approval rule. Say which sites are visited and which activities are sampled. A warehouse that never touches the model can stay off the AIMS scope. A small office that approves the model cannot.

6. Questions to put on the RFQ

Put these on the pack, in writing, so every reply restates the same facts. Leave fees, day-rate guesses, and "how long it usually takes" off this page. Ask the body to show its own calculation against your scope.

1. What legal entity will sign, and which accreditation mark will be printed on the ISO/IEC 42001 certificate?
2. On what date did you last read that entity's live schedule, and does it list ISO/IEC 42001:2023 for our locations?
3. If the schedule prints roles, which of developer, producer, provider, and user will the audit cover? If it does not print roles, which roles will you sample, and why?
4. Who will audit, and what AIMS audits have they done that resemble our systems (in-house model, third-party model, shop-floor system, or model inside client work)?
5. We already hold ISO/IEC 27001, ISO 9001, or both. Can this legal entity cover the standards on this pack? What will be one programme, and what stays a separate certificate?
6. Restate our scope: systems in, systems out, sites, central function, and headcount band per site. Flag anything you will not accept.
7. Which offices will do the work, and is each office an accredited location on the schedule?
8. Did this body, or a related company, write the AI management system? If yes, say so. The implementer is not the certifier.
9. If 42001 is a later add, what has to be true before you will quote it, and what recheck date should we put on the file?

Three to five bodies is enough when each one can actually be awarded. Build that set from the constraint (the mark, the sector, the standards on this cycle), then score replies. One famous name and four bodies that cannot sign 42001 is a one-horse shortlist.

7. Mistakes that waste the first round

Sending 42001 to the 27001 registrar without reading the schedule. The relationship is useful. The scope is a separate line. Ask, then keep them or add a second body.

Treating a UK company and a US company as one accreditation. NQA's profile is the explicit case: UKAS lists ISO/IEC 42001, and the ANAB scope for National Quality Assurance, USA does not. A-LIGN's profile is the reverse on the UKAS side: ANAB lists 42001, and the UKAS schedule does not. Ask which mark will be printed.

Buying the group announcement. A press release that a group "obtained accreditation" or "associated its offering" with an accreditation body is a prompt to look up the legal entity. It is not a row in the table above, and it is not a signature on your certificate.

Asking to be certified to ISO/IEC 42006. That document regulates the certification body. Your certificate, when the system exists and the audit is done, is to ISO/IEC 42001:2023.

Confusing a framework profile with the certificate. A NIST AI RMF profile can describe the same systems. It does not fill a field that says ISO/IEC 42001 certificate. The comparison is ISO 42001 vs NIST AI RMF.

Putting 42001 on the pack before an AIMS exists. Inventory, impact and AI risk records, and a named owner for approval and retirement are the system. A slide of model logos is a project. Finish it, or hire implementation help that will not also certify you, then send the RFQ.

Using the plant site list as the AIMS site list. The model often lives somewhere the ISO 9001 certificate never named. Write that address down before anyone counts visits.

Scoring the logo before the legal entity. Put the familiar name and the specialist in the same columns: entity, mark, 42001 line, 27001 line, 9001 sector, auditor examples, scope restatement. The brochure loses to the schedule.

8. Send one pack

When the standard is ISO/IEC 42001:2023, the system exists, and you know which mark the customer accepts, send one scope pack to every body you could award. The checklist is the RFQ / scope pack. Verify each legal entity with the accreditation walkthrough before you treat a reply as comparable.

Use Get quotes for that pack. Tick ISO/IEC 42001 only for this cycle. In Scope notes, name the mark (ANAB or UKAS), the AI systems in and out, the sites, and whether 27001 or 9001 shares the programme. Put any certificate you already hold in Existing certificates. Submit once. The body that cannot show ISO/IEC 42001 on the live schedule should fall out before you compare anything else.