Enterprise vendor questionnaires have started asking about ISO 42001, the international standard for managing AI risk, and about whether a product’s AI features have been tested. For a company that already holds ISO 27001, the request looks familiar: both standards share the same structure, and both certificates last three years with an audit every year. What trips teams up is the AI-specific part. Some skip AI testing entirely, while others assume a pentest alone earns the certificate. This guide explains what ISO 42001 certifies and where a penetration test fits in.
Quick Answers
What is ISO 42001?
The international standard for managing AI risk. An independent auditor checks that a company keeps its AI under control, with clear owners and regular risk reviews, and then issues a certificate.
Does ISO 42001 require a penetration test?
No. Auditors still ask for proof that the AI’s technical safeguards work, and a penetration test report (the results of authorized security testing) is the clearest proof available.
When should the AI be tested?
Before the main certification audit, with enough time to fix what the test finds and retest. After that, once a year and whenever the model or the tools it connects to change.
What an ISO 42001 Certificate Covers
ISO 42001 certifies how you run your AI, not the AI itself. The auditor checks that the company has a working process for finding AI risks and dealing with them. That means knowing every AI system in use, including models bought from vendors, and assessing how each system could harm the people who use it or are affected by its decisions. When problems surface, there has to be a record of them being fixed. The certificate confirms that this system exists and works. It doesn’t say whether a particular model gives accurate answers or can be tricked into leaking data.
Why Customers Are Asking About It Now
Large buyers have started treating AI features the way they treat any vendor system that touches their data: they want an independent party to vouch for it. Vendors without that proof tend to get longer questionnaires and custom audit requests, and the deal slows down while the security review drags on. A certificate shortens that conversation.
The big AI platforms certified early. Anthropic announced its certificate in January 2025 and ServiceNow followed later that year, so procurement teams learned the name from their own suppliers. ISO 42001 is also the only international standard for managing AI that an outside auditor can certify. The NIST AI Risk Management Framework, its closest US counterpart, offers guidance but no certificate.
How the Standard Is Built
ISO 42001 has two layers. The first is a set of rules every certified company must follow, written in clauses 4 to 10. Leadership has to own the AI program and publish an AI policy. Risks get assessed on a schedule and again whenever something changes, and the company sets objectives, trains its people, audits itself, and fixes what that internal audit turns up. Anyone who has been through ISO 27001 will recognize nearly all of this layer. The impact assessment mentioned earlier is the one new piece, a documented look at how each AI system affects people outside the company, and ISO 27001 has nothing like it.
The second layer is Annex A, a checklist of 38 controls grouped into nine areas. A company doesn’t have to use all of them. It picks the controls that match its risks and explains each choice, including the ones it leaves out, in a Statement of Applicability (a document the auditor reads closely to see if the choices make sense).
| Annex A area | What it covers |
| A.2 Policies | A written AI policy, kept current |
| A.3 Internal organization | Who owns AI decisions and where problems get reported |
| A.4 Resources | The data, tools, computing power, and people behind each system |
| A.5 Impact assessment | How the company judges effects on people and society |
| A.6 AI system life cycle | Design, testing, release, monitoring, and logging |
| A.7 Data | Where training and input data comes from and how good it is |
| A.8 Information for users | What users are told and how they report problems |
| A.9 Use of AI | Keeping each system within its intended purpose |
| A.10 Third parties | Responsibilities shared with suppliers and customers |
Where a Penetration Test Fits
If your AI feature can read customer data or act for a user, part of the audit depends on evidence only testing can produce. Most of ISO 42001 is governance: policies, role assignments, training records, impact assessments. Documents prove those, and a pentest adds nothing. Technical controls are another story. A policy saying the assistant only sees the current customer’s records proves little until someone tries to make it see more.
The closest fit is the life cycle area (A.6), which expects AI systems to be verified before release and monitored once live. An AI pentest is a documented attempt to make the system misbehave, with each finding rated and later retested. It also gives the auditor something concrete to trace: if a tester’s attack attempts never showed up in the logs, monitoring has a gap.
Data controls (A.7) get a check too, since a file planted in the knowledge base the AI reads can carry hidden instructions of its own. Third-party controls (A.10) come with a firm boundary. Testers can’t attack the model vendor’s servers, though they can check how your product stores its API keys and what customer data it sends out.
Underneath sits ordinary application security. An assistant that fetches another customer’s file is a plain IDOR flaw, and the same engagement covers it.
The results feed back into the management system. Findings become inputs to the next AI risk assessment, and the retest report shows the auditor that problems were corrected.
What an ISO 42001 Pentest With CYBRI Looks Like
If your certification audit is already on the calendar, the test gets scheduled backward from that date, with room to fix findings and retest first. A CYBRI ISO 42001 penetration test starts with a map of the AI inside your audit scope: the models you call, the agents and the tools they can use, the knowledge bases they read, and the APIs and data behind them. That map should match the AI system inventory your auditor sees, so the report and the certificate describe the same product.
Testing follows the OWASP Top 10 for LLM Applications, the industry’s reference list of how AI applications get attacked, in its current 2026 edition. Testers try to override the AI’s instructions with hidden commands (prompt injection) and coax it into revealing customer data or its own configuration. They push agents toward actions beyond their permissions and plant poisoned content in the sources the AI reads. The same engagement also checks the APIs and cloud setup the AI runs on. Testers log in as each of your user roles and work manual-first.
Each finding in the report is tied to the Annex A area it affects, so your compliance lead can carry it into the risk assessment and the auditor can trace it to a control. Once your team ships fixes, the testers check them again and issue an updated report for the audit file.
Every engagement includes:
- Senior, OSCP-certified testers working manual-first, with tools in a supporting role
- Authenticated testing across every user role the AI serves
- Same-day alerts for critical issues, ahead of the final report
- A two-part report: a plain-language summary for leadership and the auditor, plus technical findings scored on CVSS 4.0 (the standard severity scale) with steps to fix each one
- Findings mapped to ISO 42001 Annex A, and to ISO 27001 or SOC 2 if you hold those too
- Remediation guidance and a retest, closing with an updated report as corrective-action evidence
- A walkthrough call with the testers after delivery
To scope a test around your ISO 42001 audit date, contact CYBRI.
Frequently Asked Questions
Does an ISO 27001 pentest count toward ISO 42001?
Partly. Companies already running ISO 27001 will recognize the setup, since the internal audit and management review can serve both standards, and many treat 42001 as an extension of the program they already have. The difference is the risk being managed: ISO 27001 protects data, while ISO 42001 also covers bias and an AI acting outside its intended job. An ISO 27001 penetration test covers the servers, APIs, and access controls the AI runs on, and that evidence still counts. It rarely tests how the AI behaves, such as prompt injection or what an agent can be talked into doing, so that part has to be added to the scope.
Does ISO 42001 certification cover the EU AI Act?
No, though it helps. Under the Act, the presumption of compliance comes from EU harmonized standards cited in the Official Journal. The first one, EN 18286 on quality management for AI providers, was cited in October 2026, and ISO 42001 isn’t on that list. Obligations for most high-risk AI systems now begin in December 2027.
How much does an ISO 42001 pentest cost, and how long does it take?
Price follows scope: the number of AI systems, agents, and data sources in the test, plus how much of the surrounding app and APIs comes along. CYBRI quotes each engagement after a short scoping call, and the pricing page shows current starting points. Most AI tests run 2 to 3 weeks. Add time for your team’s fixes and the retest, and book the work so the updated report is ready before the certification audit.
Get the AI Tested Before the Auditor Arrives
A rough list of your AI features is enough for the first call. The call works through which models, agents, and data sources sit inside the audit scope, then sizes a test that wraps up before the certification audit. Book a scoping call with CYBRI.
