ISO 42001 Certification in Numbers: ISO Survey 2025

The ISO Survey 2025 counts 271 valid accredited ISO/IEC 42001 certificates covering 572 sites as of December 31, 2025, in 40 countries and territories. The United States has the most, with 100, followed by India, the Republic of Korea, Türkiye and the United Kingdom. ISO added the standard in the 2025 edition; the 2024 edition did not report it, so there is no earlier figure to compare with. ISO notes that some certificates may not yet be in its data, so treat 271 as a floor. The standard itself was published in December 2023.

Reviewed by Dor Israel, Founder · Updated October 6, 2026

Related toolkit: ISO 42001 AI Management System Toolkit ($99)

Free: The ISO 42001 Starter Checklist for an AIMS (9 steps) →

The headline numbers

The ISO Survey is ISO’s annual count of valid certificates to selected management system standards. In ISO’s words, it is “an annual survey of the number of valid certificates issued worldwide against selected ISO management system standards.” The 2025 edition counts certificates and sites as of December 31, 2025. ISO’s explanatory note for it is dated October 2026.

ISO/IEC 42001 is new to the Survey. ISO’s note says: “Data for ISO/IEC 42001 and ISO 37301 have been included in the 2025 survey.” The 2024 edition’s files have no ISO/IEC 42001 table, so no change over time can be stated.

The Survey counts certificates and sites, not organizations. ISO’s definitions: “A certificate is the document issued by a certification body once the client has demonstrated conformity to the standard and a ‘site’ is a permanent location where an organization carries out work or provides a service.” There are more sites (572) than certificates (271), so some certificates cover more than one site. The files do not say how many organizations hold these certificates.

Where ISO 42001 certificates are

The United States has the most ISO/IEC 42001 certificates: 100 of the 271, or 36.9%. India (25), the Republic of Korea (24), Türkiye (19) and the United Kingdom (16) follow. Together those five hold 184 certificates, 67.9% of the total. China has 14. In all, 40 countries and territories have at least one certificate. The table shows the ten with the most; ISO’s results files on IAF CertSearch list them all.

Three coverage notes from ISO apply. First, for 2025 ISO added statistics from UKAS CertCheck, which it says gave “a more complete representation of certifications across a range of countries, particularly the United Kingdom.” Second, German coverage “remains incomplete,” because data was not available from all certification bodies accredited by DAkkS, Germany’s accreditation body. Third, ISO’s note names the standards for which CNAS, which supplies China’s statistics, provided certificate breakdowns. ISO/IEC 42001 is not among those named, and the note does not say where China’s ISO/IEC 42001 figure comes from.

ISO’s caution covers all of this: “Interpretations of the results and any conclusions on trends should take into account that coverage may vary across countries, industries, and standards.”

Which sectors hold the certificates

Most certificates have no sector on record. ISO’s sector table for ISO/IEC 42001 adds up to 271, the certificate total. Of those, 171 (63.1%) are listed as “Sector unknown.” That leaves 100 certificates with a reported sector, and 92 of the 100 are information technology.

Read the 92 with care. It describes the 100 certificates with a reported sector, not all 271. Those 100 come mostly from a few countries: in ISO’s sector-by-country table, China and India together supply 61 of them. That table does not always match the country certificate counts; China, for example, has 37 sector entries against 14 certificates, and ISO does not explain the difference. So the sector mix of all ISO/IEC 42001 certificates is unknown.

How 271 compares with other standards

For scale, the same 2025 edition counts 1,611,729 ISO 9001 certificates and 125,622 ISO/IEC 27001 certificates. These are counts from a single edition. They show size, not speed. With no earlier ISO/IEC 42001 figure, the Survey cannot say whether the standard is gaining certificates faster or slower than any other. ISO also cautions that coverage may vary across standards, so even the gap in size is approximate.

The standard is young. ISO’s own page for ISO/IEC 42001:2023 gives the publication date as December 2023 and marks “International Standard published” on December 18, 2023. The Survey’s count date, December 31, 2025, is just over two years later.

What the count includes and what it leaves out

The count covers accredited certificates only. ISO says the 2025 edition “reports valid accredited management system certificates and associated sites as at 31 December 2025.” Certification bodies accredited by members of Global Accreditation Cooperation Incorporated (Global ACI) provide the data, which is uploaded to IAF CertSearch. ISO’s results workbook defines a valid certificate as one issued “during the year of the survey or in the two years preceding it that is still valid on 31 December of the year of the survey.”

What is not counted:

• Certificates from certification bodies that are not accredited.
• Certificates from accredited bodies that have not uploaded their data. ISO’s note says: “While the vast majority of certification bodies have uploaded their data, a small percentage have not yet completed this process. As a result, some certificates may not yet be reflected in the database or the Survey.”
• Organizations that follow the standard without being certified. The Survey counts certificates, not adoption.

Participation is high but not complete. For 2025, ISO says “80 of the 81 accreditation bodies in scope for the Survey participated in IAF CertSearch,” and 2,574 certification bodies take part in IAF CertSearch.

ISO itself does not certify anyone. In ISO’s words: “ISO does not perform certification or issue certificates, and it does not permit anyone to use the ISO logo in connection with certification.” Certificates are issued by certification bodies.

If a customer asks about ISO 42001

A security questionnaire or a contract may ask whether you are ISO 42001 certified. A few plain points help you answer.

• Answer the exact question. “Certified” means a certification body has issued a certificate after auditing your AI management system. If that has not happened, say whether you are working toward it, or that you follow parts of the standard without a certificate. Do not call yourself certified until a certificate exists.
• Ask what the customer needs. It may be the certificate itself, or evidence of how you govern AI, such as an AI policy, AI risk and impact assessments, and named owners. The answer decides how much work is ahead.
• Know the scale. ISO counts 271 valid accredited certificates worldwide as of December 31, 2025.
• If someone shows you a certificate, check who issued it. The Survey counts only certificates from accredited certification bodies.

Documentation is one part of the work. A template set can speed up drafting the policies and procedures, but it does not make anyone certified. Certification comes from an audit of a management system that is in operation.

Sources

Every ISO figure on this page comes from the sources below. We did not adjust ISO’s counts; shares and ranks are our arithmetic. One outside estimate is quoted in the questions below and labeled as such.

• ISO Survey 2025: explanatory note (ISO/CASCO, October 2026) and results files, on IAF CertSearch: https://iafcertsearch.org/services/iso-survey (accessed October 6, 2026).
• ISO Survey 2024: explanatory note (ISO/CASCO, September 2025) and results files, same location, used only to confirm that the 2024 edition did not report ISO/IEC 42001.
• ISO, ISO/IEC 42001:2023 standard page: https://www.iso.org/standard/42001 (accessed October 6, 2026).
• ISO, certification page: https://www.iso.org/certification.html (accessed October 6, 2026).
• Atoro, “How Many Companies Are ISO 42001 Certified?”: https://atoro.io/how-many-companies-are-iso-42001-certified/ (accessed October 6, 2026). An outside estimate, not an ISO figure.

ComplianceDocs is not affiliated with ISO, IAF or IAF CertSearch. For ISO/IEC 27001 figures from the same edition, see our ISO 27001 certification statistics page.

Frequently asked questions

How many companies are ISO 42001 certified?

The ISO Survey counts certificates, not companies. Its 2025 edition counts 271 valid accredited ISO/IEC 42001 certificates, covering 572 sites, as of December 31, 2025. The files do not say how many organizations hold those certificates. Treat 271 as a floor: ISO notes that “some certificates may not yet be reflected in the database or the Survey,” and certificates from bodies that are not accredited are not counted. Some published estimates are higher. Atoro wrote that public announcements “suggest that only around 350 organisations worldwide held ISO 42001 certificates by spring 2026,” a count it says “has to be assembled from certification-body announcements and company press releases” (https://atoro.io/how-many-companies-are-iso-42001-certified/, accessed October 6, 2026). The two figures measure different things: ISO counts accredited certificates in its data as of December 31, 2025; Atoro’s figure is an estimate of organizations, drawn from public announcements through spring 2026.

Which country has the most ISO 42001 certificates?

The United States, with 100 of the 271 valid certificates in the ISO Survey 2025 (36.9%). India (25), the Republic of Korea (24), Türkiye (19) and the United Kingdom (16) follow. China has 14. In all, 40 countries and territories have at least one certificate.

Is the ISO 42001 certificate count complete?

No. ISO says “some certificates may not yet be reflected in the database or the Survey,” because a small percentage of certification bodies have not uploaded their data. For 2025, 80 of the 81 accreditation bodies in scope took part, and ISO says German coverage remains incomplete. The count also leaves out certificates from bodies that are not accredited. Read it as a floor.

Where does the ISO 42001 certification data come from?

From the ISO Survey 2025, which ISO compiles “primarily from anonymised and aggregated data in IAF CertSearch,” the global database of accredited management system certifications. Accredited certification bodies upload the data. For 2025, ISO also added statistics from UKAS CertCheck. ISO says the detailed results are on IAF CertSearch (https://iafcertsearch.org/services/iso-survey).Related: ISO 27001 certification statistics from the same edition

How often is the ISO Survey updated?

ISO describes it as “an annual survey.” The 2025 edition counts certificates as of December 31, 2025, and its explanatory note is dated October 2026. The 2024 edition’s note was dated September 2025. ISO added ISO/IEC 42001 in the 2025 edition, so there is no earlier ISO figure to compare with yet.

Has the number of ISO 42001 certificates grown?

The Survey cannot say yet. ISO added ISO/IEC 42001 in the 2025 edition, and the 2024 edition did not report it. ISO’s comparison file for 2025 has no ISO/IEC 42001 table. The Survey has no earlier figure to measure growth against.Related: ISO 42001 vs the EU AI Act

Related guides: ISO 42001 · AI Governance (EU AI Act & NIST AI RMF)

Toolkits that help

Related articles

• ISO 27001 Certification in Numbers: The Latest ISO Survey Data
• Do You Need ISO 42001? AI Management Systems vs the EU AI Act
• EU AI Act Deadlines: The Verified Timeline
• What a Data Breach Costs: The Verified 2026 Numbers
• ISO 27001 Documentation Toolkits Compared: 2026 Prices and What You Get

← All articles