ISO 42001 is in your RFP. What to send when you don't have the certificate

If a procurement questionnaire asks whether you are ISO 42001 certified and you are not, do not answer "we have an AI policy". Send the five artefacts the standard exists to certify, written for the system you actually run:

1. An AI inventory. Every AI system inside the product: what it does, which model, where the data goes, who owns it.
2. A risk register. The ways each system fails, who is affected, and the control you put in front of each failure.
3. Eval and test records. What you measured, when, against which frozen set, and the numbers that came out.
4. A human-oversight procedure. Where a person sits in the loop, with what authority, and how a decision is reverted.
5. A supplier list. Every model and data provider underneath you, and what you rely on each one for.

The certificate says an auditor checked that a management system producing these exists. The artefacts are that system. A buyer's security reviewer can read them this quarter. By the figures below, the certificate takes longer than a quarter to get.

Why this is on the table now

The numbers come from a practitioner's post in an AI-agents community, paraphrased here in our words. Three months earlier, ISO 42001 came up in about 5% of the RFPs they saw. Now it is about 30%. The same post relays consultants' estimates of roughly 40% of corporate RFPs to AI vendors in the EU and roughly 25% in North America by mid-2026. BCG said on 27 January 2026 that it was among the first 100 organisations in the world to be certified.

What the standard certifies, per the same post: a management system, not a model. 39 controls in nine categories. Certification runs 6 to 12 months, and an initial audit starts at $5,000 and goes past $30,000. We have not run one ourselves, so those are the source's figures, not ours.

The second piece of evidence reached us directly. A founder told us their AI deal now dies in the client's security questionnaire, not at the demo. The AI section of the vendor questionnaire has become the gate, and "we have a policy" does not pass it. The reviewer wanted artefacts, not a declaration.

The strongest version of "just get certified"

If 30% of RFPs already ask and the first 100 organisations are already in, the certificate turns into a filter, and a folder of artefacts reads like an excuse. For a company selling AI to regulated EU buyers at volume, we think that is right. Start the audit. The artefacts are the first months of it anyway.

For everyone else, the 6 to 12 month figure is the problem. A questionnaire due in two weeks cannot wait for a certificate, and we would rather send an honest "no, and here is what we have" than a vague "in progress".

What would change our mind: a questionnaire that rejects a complete artefact set with no certificate attached. We have not seen one. The failure relayed to us was a policy with nothing behind it.

What each artefact looks like

The examples below are illustrative. The system is a made-up lead-scoring assistant, not a client. The shape is what matters: every line carries a date, a number or a named role, so a reviewer can check it instead of trusting it.

The AI inventory, one entry per system:

system: lead-scoring-assistant
purpose: ranks inbound leads for the sales desk
model: <provider> / <model id>, version pinned
inputs: CRM fields (company, size, source); no free text from the public
outputs: a score 0-100 and a one-line reason
data leaves the tenant: yes, prompt to provider; retention 0 days per contract
owner: head of product
last reviewed: 2026-09-30

The risk register, one row per failure mode:

id: R-07
system: lead-scoring-assistant
risk: scores drift after a model version change
who is affected: sales desk works the wrong leads first
likelihood / impact: medium / medium
control: version pinned; golden set of 200 leads re-scored on every change;
         alert if mean delta exceeds 3 points
residual risk: accepted by head of product, 2026-09-30

An eval record, one per run:

eval: golden-leads-v3 (200 items, frozen 2026-07-14)
run: 2026-09-30 14:10 UTC, model <id>, prompt v12
result: mean abs delta vs prompt v11 = 1.8 points
        3 items over threshold, each reviewed by hand
verdict: pass
attached: run log, per-item diff, reviewer notes

The human-oversight procedure, one per decision the system can make:

decision: assistant marks a lead "disqualified"
oversight: a person on the sales desk sees the reason and can override in one click
authority: any rep for their own leads; team lead for anyone's
revert: an override is logged; the lead returns to the queue within the hour
escalation: 3 overrides on one reason in a week -> prompt owner reviews the rule

The supplier list, one line per dependency:

<model provider>     role: inference        terms: enterprise, zero retention   reviewed: 2026-09
<vector db vendor>   role: retrieval store  terms: SOC 2 report on file         reviewed: 2026-09
<enrichment API>     role: company data     terms: DPA signed                   reviewed: 2026-08

Five documents, none longer than a page per system. A reviewer who asked "are you certified" and gets these has something to score. A reviewer who gets a policy has a promise.

How to produce them without a compliance team

This part is our opinion. The artefacts are cheap when they fall out of how the system is built, and expensive when someone writes them afterwards from memory. Three habits do most of the work:

• Pin and log. A pinned model version is an inventory row. A run log with a timestamp is half an eval record.
• Freeze a golden set. A fixed set of inputs, re-run on every change, is the control in the risk register. Without it, "we test for drift" is a sentence, not a control.
• Build the override as a feature. A button that lets a person reverse the system's call, with a log behind it, is the oversight procedure. It ships inside the product, not in a binder.

Then the questionnaire answer writes itself: no certificate yet, here is the inventory of what runs, here are the risks and controls, here are the numbers from the last run, here is who can overrule the system and how. If certification is on your roadmap, say so with a date you can defend. If it is not, say that too.

FAQ

How long does ISO 42001 certification take, and what does it cost? By the practitioner's post we rely on here: 6 to 12 months, with an initial audit from $5,000 to $30,000 and above. We have not been through the process, so treat those as the source's figures.

Does "we have an AI policy" pass the questionnaire? Not in the case relayed to us. The reviewer wanted the artefacts the policy claims to produce: the inventory, the register, the records.

Does the standard certify our model? No. It certifies a management system around the AI you run: 39 controls in nine categories, per the source. A certified company can still ship a bad model. An uncertified company can still show its eval records.

Can we answer an RFP honestly without the certificate? Yes. The honest answer is "no" to the checkbox and the five artefacts attached. Whether that passes is the buyer's call, and it depends on their sector and risk appetite.

Is this legal or compliance advice? No. We are an engineering studio, not auditors or lawyers. The artefacts above describe engineering practice. For the standard's exact requirements, read the standard or hire an auditor.

A related case

The cleanest eval record we know of is one the product generates about itself. In RE Intelligence, our analytics product for the Dubai property market, the rule is "Postgres owns the truth, AI owns the story": every number comes from a deterministic query and the model only narrates what the data already proved. Forecasts are archived and graded against what actually happened, and the accuracy is shown to the user rather than kept in a drawer. That is a risk register entry, an eval record and an oversight line, produced by the system itself. The case is at iloblique.com/re-intelligence, and the product is at reint.ae.

If you have something worth building, we'd like to hear about it.

Sources: a practitioner's post in an AI-agents community (2026), paraphrased, for the RFP share, the consultants' estimates, the structure of the standard and the audit timing and cost; BCG's announcement of 27 January 2026 on being among the first 100 certified organisations; a founder's account relayed to us directly on the questionnaire gate.