Scoping ISO 42001 for the mid-market: audit-ready without a six-figure engagement
A global-firm engagement will get you certified — and produce a beautiful binder for a five-figure fee. Having sat on both sides of those engagements, I can tell you most of the cost is scope you don't need. A mid-sized company can get genuinely audit-ready by being disciplined about three things.
Scope tightly — this is where the money goes
The single biggest cost driver is an over-broad scope. You do not have to certify every corner of your company at once. Define an AIMS scope around the AI systems that actually matter — the ones that touch customers, decisions or data — and be explicit about what's excluded. A tight, defensible scope shrinks the work dramatically without weakening the certificate, because the certificate is only ever for the scope you declared.
Do the real work yourself — templates exist
The documents — policy, risk register, impact assessment, RACI, Statement of Applicability, procedures — are not the hard part; good templates exist, including generated ones. What a consultant historically charged for was assembling them for you. If you'll invest the hours to make them specific to your context, you've done the majority of the real work at zero consulting cost. The tools do the structuring; you supply the facts about your business.
Buy judgement, not paperwork
So what should you actually pay for? Judgement, applied to your case: which risks are real for you, which controls you can honestly scope out, and where an auditor will push. That's a narrow, high-value slice — a review or a few checkpoints — not a full engagement. The mid-market opportunity is exactly this: get the documents and the strict assessment for free, and buy only the human judgement, at a price that fits.
Sequence it so it's finishable
Overwhelm kills mid-market programmes. Sequence the work so each step feeds the next — policy, then risk, then impact, then RACI, then SoA, then procedures — and give it a finite runway rather than an open-ended project. A structured fifteen-day path to a first audit-ready document set is far more likely to finish than a "we'll get to it" initiative that never has a deadline.
Educational orientation, not legal advice. ISO/IEC 42001 references current as of September 2026. Certification is performed by accredited bodies.