ISO 9001 vs ISO 42001: which certificate goes on this RFQ

This page is a buying comparison. It is for operations, quality, and AI leads at mid-market manufacturers and professional-services firms who are about to send a registrar RFQ and cannot agree whether ISO 9001 or ISO/IEC 42001 belongs on it.

Those standards are not interchangeable logos. 9001 is a quality management system. 42001 is an artificial intelligence management system (AIMS). Customers mention both in the same meeting. Salespeople will offer to quote both this afternoon. The useful question is a procurement question: which certificate does this cycle have to produce, and can you staff the system behind it.

The four honest answers are 9001 on this RFQ, 42001 on this RFQ, both as a sequence you can actually staff, or neither until a system exists. "Both this afternoon" is rarely one of them.

The multi-year sequence is the 9001 → 27001 → 42001 path. Quality versus information security on this RFQ is ISO 9001 vs ISO 27001. Information security versus AI management is ISO 27001 vs ISO 42001. Whether the system is real enough to book Stage 1 is first ISO certification. After you pick the standard, the calendar from that pack through certificate issue is how long ISO certification takes. You still write one outbound pack, choose a registrar, read the quote, and verify accreditation for the legal entity and the edition you will claim. This page does not invent prices, day-rate totals, or accreditation identifiers. Confirm the live schedule in the quarter you would book.

The decision here is narrower: 9001 on this RFQ, 42001 on this RFQ, a sequenced pair, or neither yet. Then one pack. When the live fork is an accredited AI management certificate versus a NIST AI Risk Management Framework profile, use ISO 42001 vs NIST AI RMF.

1. What each standard actually manages

Skip the clause lists. Buyers do not award a certificate because they memorized a table of contents.

ISO 9001 is how a customer checks that you can repeat the work and correct it when it fails. A certification body samples that quality system: how an order or an engagement becomes a product or a service, how nonconforming work is caught, and who owns the process. The certificate records the management system. It does not promise that every unit, every deliverable, or every model output is correct.

On a plant the interviews sit in receiving, production, inspection, and with the people who run them. A vision cell that accepts or rejects parts is still a quality process if the customer is scoring how nonconforming product is stopped. In a professional-services firm the interviews sit in how work is taken, staffed, reviewed, delivered, and how a complaint is handled. The owner is the person who already runs that work and can speak without a script. An AI lead holding a copied quality manual is not that person.

ISO/IEC 42001 asks whether you can govern the AI systems you develop, provide, or use, and prove that governance. A certification body samples that AI management system: which systems are in scope, how you assess impact and AI risk, who may approve a system, how the lifecycle runs from data and deployment through monitoring and retirement, and how you treat third-party and general-purpose models. The certificate records that system. It does not promise that a model is accurate, fair, or lawful in every jurisdiction. A copilot note is not an AIMS. A quality manual with "AI" typed on the cover is not one either.

On a plant, the AIMS is often one vision cell, a scheduling model, or a narrow set of tools that now do production work, plus the people who approve them. The quality system may already describe the inspection step. It does not, by itself, name who may change the model, what impact was assessed, or how you take the model out of use. In a professional-services firm the AIMS is the models embedded in delivery: drafting, analysis, recommendations, code, or client-facing outputs that you will claim. A chatbot someone tried once is a different object. The owner is whoever can show the inventory and the approval record. The quality manager is that person only when they actually own those decisions.

You can hold both certificates eventually. This page is about which one this RFQ is for.

2. When 9001 alone is enough this cycle

Start with 9001 when the pressure in front of you is quality, and an AIMS mark will not lose a bid, a renewal, or a site this quarter.

That is still the usual manufacturer case. Portals, primes, and export paperwork treat 9001 as table stakes, and the plant already half-runs the work an auditor will sample. It is also the rational gate for a professional-services firm whose contracts score how work is taken, reviewed, and closed, when nobody has named a certified AI management system on a date you can point at.

Put 9001 on this RFQ when most of these are true:

• The customer, portal, bid, or supplier approval in front of you names 9001, or names "an ISO certificate" and means quality.
• You can name the legal entity, the sites that do the certified work, and a quality or operations owner who will be in the room.
• Documented processes roughly match Tuesday. Internal audit and management review can touch this system before you invite a body. That test is first-certificate readiness.
• The AI conversation is a forecast: a pilot on one line, a copilot in email, a board slide, a customer question that says "do you use AI" and does not name a certificate, or a private-equity note that governance might come up. A forecast is not a date that kills a contract this cycle.
• You are not offering a quality certificate as a stand-in for an AI-management promise already in the contract or the tender. If the exhibit names ISO/IEC 42001 or an AI management system, 9001 will not clear it.

A later 42001 add is a normal plan. One line on the pack is enough: which AI systems you expect to govern, and that they are not this cycle. Leave 42001 off this RFQ while the inventory is a list of tools nobody owns. If the live fork is quality versus information security, and AI governance is not this cycle, the buying comparison is ISO 9001 vs ISO 27001. If the live fork is environment or occupational health and safety beside quality, that argument is the IMS buying guide, or the 9001 vs 14001 and 9001 vs 45001 comparisons. Do not add those standards here to look thorough.

If the portal requires 9001 and the quality system does not exist, build the system, then send the pack. An RFQ sent so the quote creates a deadline is how Stage 1 writes findings you already knew. Readiness still has the first-certificate shape. The content is the quality system. Who writes the system versus who certifies it is consultant vs certification body.

A vision cell, a scheduling model, or a model inside client delivery can sit inside the quality process and still be out of this certificate. Say that boundary in one sentence. Do not let a salesperson turn the cell into an AIMS scope because the word "AI" appeared on the tour.

3. When 42001 is the real ask

Start with 42001 when a customer, a tender, an insurer, or a counsel-backed requirement will not let you through without an AI management certificate this cycle, and you can show an AIMS with a named owner.

That is still the less common mid-market case. It shows up in three places, and they are not the same pressure.

A customer or a bid names the certificate. A prime will not accept a vision system, a scheduling model, or models inside delivery without ISO/IEC 42001, or an accredited AI management certificate, on a date you can point at. A competitor's homepage does not create the gate. A named field with a date does.

AI risk is already in the work you will claim. You develop, provide, or use systems that change a product decision, a client recommendation, or an output a customer will rely on, and someone with authority has decided that governance of those systems is a condition of the work. The inventory, the impact records, and the approval rule have to exist before the pack goes out. A policy that bans some tools and ignores the model that ships is not that system.

Regulator pressure has become a certificate requirement. Some customers, public-sector tenders, and insurers are starting to ask for a management system around AI because they, or their counsel, expect governance evidence. That becomes this RFQ when the document in front of you names ISO/IEC 42001 or an accredited AIMS on a date you can point at. A headline, a slide that says regulation is coming, or a general counsel memo that says "we should be ready" is a forecast. 42001 can be a way to run the system those questions will sample. It does not make a model lawful, it does not replace legal advice, and it is not a statute that says buy a certificate by Friday. If counsel has not named the certificate, you are still in section 2 or in "neither yet."

Put 42001 on this RFQ when most of these are true:

• A named customer, questionnaire, tender, insurer, or contract requires ISO/IEC 42001, or an accredited AI management system certificate, on a date you can point at.
• You can list the AI systems in scope: systems you develop, systems you provide, and systems you use, including third-party and general-purpose models when they do the certified work. Pilots you will not claim stay out, with a reason.
• Someone other than a hopeful quality manager owns AI policy, impact and AI risk assessment, approval, monitoring, and retirement, and can be interviewed.
• Documented information matches Tuesday. The inventory is updated. Material systems have impact records. Model suppliers are visible. There is a way to take a system out of use.
• You can name where those systems are approved and where they run. That address is often a development office, one production line, or a delivery team. It is often not the largest factory, and it is often not the whole firm.
• 9001 pressure is a forecast, or you already hold 9001 and this RFQ is an add. An existing quality certificate does not put the AI systems into scope, and it does not appoint an AIMS owner.
• You are not offering an AIMS certificate as a stand-in for a quality promise already in the contract or the supplier approval. If the exhibit names ISO 9001 or a certified quality management system, 42001 will not clear it.

If the bid requires 42001 and the AIMS does not exist, build the system, then send the pack. Pasting an AI section onto the quality manual will not survive Stage 1. If the missing piece is who may approve a model, finish that ownership before you collect day counts. Sequence and readiness live on the path guide and first ISO certification. The 42001 briefing is where the recheck habit for a moving AIMS schedule already lives.

Leave 9001 off this cycle only when it is not the gate and you cannot staff both. Many rooms that think they belong here are still in the previous section. The customer scores how you deliver work, and AI is a paragraph in the same questionnaire. Read the field before you promote 42001.

If the paragraph is actually about information security (access, incidents, suppliers, client data) and nobody has named an AIMS certificate, stop. That buying comparison is ISO 27001 vs ISO 42001 or ISO 9001 vs ISO 27001. This page will not smuggle an ISMS onto a quality-versus-AI pack.

4. Why both this cycle is usually a sequence

Shared management-system habits do not make these two certificates one afternoon of audit.

Annex SL gives you clauses you can run once: context, leadership, planning, support, operation, performance evaluation, improvement. Use that when both systems exist. Document control, internal audit, management review, and corrective action can be shared. They are not the technical work. Process control, nonconforming product, and customer complaints are quality work. An AI inventory, impact and AI risk records, approval, monitoring, and retirement are AIMS work. A corrective action on a wrong shipment is not a model-retirement record. An impact assessment is not a customer complaint, unless you already run them as shared processes you can show.

Three facts make a combined quote a sequencing decision for most mid-market teams.

The owners differ. A quality or operations owner can walk how work is delivered. An AIMS owner can walk which systems are in scope and who may approve or retire them. One person can own both only when that person can sit both interviews, including a process example that was not rehearsed and an approval record that was not written for the visit. "The quality manager will cover AI" usually means the inventory has no owner.

The sites differ. 9001 follows the work: plants, warehouses, labs, and the offices where the certified service is run, including the second shift. 42001 follows the AI systems: where they are designed or configured, where someone approves them, and where they do the certified work. A vision cell on one line is not every plant. A model used by one delivery team is not every office. The approval meeting may sit at headquarters while the system runs somewhere else. One site list with two titles is how bodies quote different objects.

The competence and the accreditation set differ. A strong quality auditor is not automatically the person who can sample how you approve a third-party model or retire a shop-floor system. Accredited AIMS scope is a smaller set than 9001 scope, and it is still moving. The certification body that already holds your quality certificate may not hold live AIMS scope in the quarter you would book. Recheck the legal entity. The method is how to verify accreditation. The research habit, without a league table, lives on the 42001 briefing and the path guide.

One programme this cycle is honest when both systems already run under one legal entity, shared processes are real, both owners can sit the audit, and each standard has its own site story or an honest site-by-standard matrix. You may still receive two certificates. Say which processes are shared and which work is standard-specific. Let the certification body restate the method. Do not ask them to invent integration you do not operate. Ask how they staff both competences. Handing a quality auditor a new checklist does not create AIMS competence.

A sequential add is the better buy when only one system is real. Certify the gate this cycle. Add the other standard when its owner, its sites, and its documented information exist. A later add is still an RFQ, and the new scheme still gets Stage 1. Tell the shortlist which standard comes later. If the body you award now cannot cover it, the honest options are wait, add a second certification body, or plan a transfer. For most manufacturers the default order is still quality first, then security, then AI, because the path is how evidence accumulates. For many professional-services firms the quality system may already be how engagements run, and 42001 becomes the certificate only when models are in the work you will claim. Write the order you mean. Do not let the quote invent it.

A second certification body is a legitimate design when competence or accreditation differs. One body for 9001 and another for 42001 is a clean procurement when you write it on purpose. Each pack names one standard, says where the other certificate sits, and goes only to bodies you could award for that standard. Two requests to "quote both and we'll see" will not converge.

Neither yet is the honest answer when you cannot show the system behind the gate. No processes that match Tuesday, and no inventory with an owner, means the room is shopping for a logo. Build the system that matches the requirement, or hire an implementer who will not also certify you, then send the pack. A downloaded quality manual and a banned-tools email are a project. They are not this RFQ.

Keep ISO/IEC 27001 visible as a decision you are not making on this page. AI systems are information systems with extra impact modes. If the customer still gates on information security, settle 9001 vs 27001 or 27001 vs 42001 before you treat 42001 as the next logo after quality. Skipping that step is how a 42001 project turns out to be a missing ISMS. If environment or occupational health and safety is the other real system, use the IMS buying guide. Do not pad this pack with the plant stack.

5. What to put on one scope pack

A quote is a designed audit programme. It starts from your facts. 9001 facts and 42001 facts are not the same list with a different title.

Scope. For 9001, name the legal entity, the products or services, the processes, and the exclusions you will defend. For 42001, name the AI systems in scope and the activities around them: develop, provide, or use, including which third-party models count. "The whole company" and "all AI" sweep in a sister entity, or put a certificate claim on a pilot that should stay out. A warehouse that only stores and ships is still a quality scope, if that is the work. A delivery team that uses one model on client work is still an AIMS scope, if that is the work. More than one location is multi-site certification scope. Write that map before anyone counts days.

Sites. This cycle names one standard's sites. The other map stays off the pack, with one line that it is a later add. If you are honestly quoting both, the pack carries a site-by-standard matrix. A design office can sit inside 9001 and outside 42001. A single production line can be central to 42001 and a thin slice of the quality tour. Do not reuse the about-page address list.

People. 9001 interviews a quality or operations owner, process owners, and someone who does the work. 42001 interviews an AIMS owner who can show the inventory, the impact records, and the rule for who may approve, monitor, or retire a system. "We'll bring the data-science lead in at Stage 2" means the pack is early. "The quality manager will cover AI" is true only when that person owns those decisions.

One page, the same pack to every body. The full checklist is how to build a registrar RFQ / scope pack. For this decision, these rows have to be explicit:

Fact	If 9001 is this cycle	If 42001 is this cycle
Standard and edition	The 9001 edition you will claim	The 42001 edition you will claim
What is in scope	Products, services, processes, exclusions you will defend	AI systems you develop, provide, or use, and what stays out
Document the owner can show	Processes that match the work, plus internal audit and management review of this system	An AI system inventory plus impact and AI risk records people use
Sites	Where that work happens, with headcount bands and shifts	Where those systems are approved and where they run, which may be one line, one office, or a delivery team
Owner	Named quality or operations owner	Named AIMS owner who can show approval, monitoring, and retirement
The other standard	Later add, or not this cycle	Later add, or not this cycle
Information security	Not this pack, unless that comparison is the real fork	The same. Do not add 27001 to look current
Who implemented	Internal, named consultant, or none	The same disclosure. The implementer is not the certifier

Headcount is a band per site, not the about-page total. A night shift still counts when the certified work runs at night. The hours a model is in production belong on an AIMS pack because they change who must be available. A thinner story for one logo ends the comparison.

If you already hold one of the two, say so on the pack: the legal entity, who issued the certificate, and whether this RFQ is an add or a request to sample the existing system again. An existing quality certificate does not put AI systems into scope. An existing AIMS certificate does not put the process map into scope. It tells a body whether they are extending a programme they already run or quoting a stranger.

6. How to ask certification bodies comparable questions

Comparable means every body quotes the same object. It does not mean you ask which logo is easier, or which standard they would rather sell.

Send the same pack. Then ask questions a body can answer without inventing your system. What comes back (programme structure, travel, exclusions, competence, and how the visits are staffed) is what CB quotes include. The split between remote and on-site time is remote vs on-site ISO audits. The dates they can actually staff belong on how long ISO certification takes. Ask for those dates on this scope. Do not average a blog timeline into a deadline, and do not put a fee, a day rate, or an accreditation number on the pack that you made up.

These questions keep the replies comparable:

1. Which legal entity would issue this certificate, and which accreditation marks that scope? Ask them to name the entity. You will check the live schedule before you award, the same way as verifying accreditation. "The group does AI" or "the group does quality" is not an answer. A brochure is not a schedule.
2. Can you staff competence for this edition, on this scope, in the quarter we would book? For 9001, that is someone who can sample how this plant or this practice delivers work and stops nonconforming output. For 42001, that is someone who can sample the way you use AI: in-house development, third-party models, shop-floor systems, or models inside client delivery. A quality auditor with a new checklist is a question, not a yes.
3. Restate the scope and the sites in your words. What is in, what is out, which exclusions you will accept, and which addresses you will visit. If their restatement adds "all AI" or "the whole company," they are quoting a different object. Correct it before you compare day counts.
4. What must already exist before you will book Stage 1, and will you implement the system you certify? The certification body samples. It does not write the process map, the inventory, or the approval rule. An offer to build the system and then certify it is a different procurement. Who writes versus who certifies is consultant vs certification body.
5. If the other standard is a later add, can this legal entity cover it, or should we plan a second body? Ask them to say which. Do not ask them to quote a standard they cannot accredit this quarter. A sequential add still gets its own Stage 1 when you are ready.
6. What is the earliest Stage 1 you can staff on this pack, what interval do you require before Stage 2, and when would a clean file reach a certification decision? Same scope, same unavailable weeks, same customer date if you have one. Unlike calendars on unlike scopes are not a comparison.

If you are honestly buying one programme for both standards, add one question: which processes will you sample once, and which work is standard-specific. Then ask who is on the team for each. If they cannot name both competences, you do not have one programme. You have a sentence.

How to choose which bodies receive the pack is how to choose a registrar. Score the replies with compare a shortlist. Invite only bodies you could award for the standard on the page.

7. Choose what goes on this RFQ, then send one pack

Make the call in one sitting. The output is a sentence at the top of the scope pack.

1. Write the actual requirement. Portal, contract, tender, insurer, counsel note. Use their words. If one field says quality and another says an AI management certificate, note which revenue is blocked this cycle. If a field still says information security, environment, or occupational health and safety, note that too, and use the comparison that matches that fork.
2. Match it to a system you can show. 9001 needs processes that match the work. 42001 needs an AIMS: inventory, impact and AI risk records, and a named owner for approval and retirement. If that system does not exist, the answer is neither yet. Do not send. Build it, or hire an implementer who will not certify you, and disclose them on the pack.
3. Name one primary standard. Mark the other "later add" or "not this cycle," unless both systems and both owners are real enough to defend at Stage 1. Both this cycle is a sequence you can staff, or one programme you already operate. It is not a request to quote two hollow systems in one afternoon.
4. Name the owner and the sites for that standard. Quality owner and the locations where the work happens, or AIMS owner and the locations where the AI systems are approved and run. If one person owns both, say that only when they can walk both.
5. Write one pack and send it to every body you might award for that standard. Ask the questions in the previous section so the replies name the same object. Confirm the legal entity's accreditation for this edition, on the live schedule, in how to verify accreditation before you invite a body you cannot award. If you are using two bodies on purpose, each still receives one pack for one standard.

If the room is still split after step 3, you have two procurements. Run the one that unblocks revenue and park the other until its system exists.

When that sentence is true, send one registrar RFQ / scope pack. Submit the same page with the Get quotes button below, including to the logo you already like. The standard on the page has to be the standard you can staff.