The Certificate You Did Not List

A procurement team sends over a security questionnaire before renewing your contract. This time, it includes questions about AI governance, AI risk management, and evidence of AI controls. Six months ago, those questions were not there. Today, they can determine whether your deal moves forward. The vendor receiving that questionnaire has a SOC 2 Type II report less than twelve months old, an ISO 27001 certificate current through March 2027, and penetration test results from a named firm. Every box that mattered in 2024 is checked. The deal is now on hold because one line in the spreadsheet came back empty: ISO 42001 status.

The cleanest way for a big buyer to push accountability down to its vendors is to ask for a recognised certificate, and ISO 42001 is the only broadly accepted one that speaks specifically to AI. So the demand is not really coming from a sudden love of the standard, it is coming from enterprises exporting their own AI governance obligations onto the companies that sell to them. High-risk AI system requirements under the EU AI Act become enforceable on 2 August 2026, and rules for general-purpose AI models took effect on 2 August 2025. The buyer sitting across from you has a compliance deadline measured in weeks, not quarters. Conformity assessments should be completed, technical documentation finalized, CE marking affixed, and EU database registration for high-risk systems completed by 2 August 2026. That buyer cannot delegate regulatory risk to a vendor who lists no certifiable AI management system. The procurement team is not asking because they read the standard and loved it. They are asking because their own legal counsel told them the contract is undefendable without it.

Amazon Web Services (AWS) was the first major cloud service provider to achieve ISO 42001 accredited certification, announced 25 November 2024. The certified scope covers Amazon Bedrock, Amazon Q Business, Amazon Textract, and Amazon Transcribe. The certification body is Schellman Compliance, LLC, ANAB-accredited. Microsoft holds ISO 42001 certification for multiple AI services including GitHub Copilot, Microsoft 365 Copilot, Microsoft Copilot Studio, Microsoft Security Copilot, and Microsoft Foundry. The certificate and audit reports are available through the Service Trust Portal. Anthropic announced ISO 42001 certification on 13 January 2025. The vendor competing for the same renewal is now being compared to a certified incumbent. A 2026 Gartner survey reported that 83% of Fortune 500 procurement teams now plan to require ISO 42001 alignment from technology vendors by 2027. Alignment does not always mean a certificate. It does always mean documentation that maps to the certificate's controls, and it means you can produce that documentation during the first security review, not three months later after the deal has already moved to a different supplier.

I have watched this movie before. This is the same pattern that made SOC 2 and ISO 27001 unavoidable a decade ago, replayed for AI. SOC 2 became a de facto requirement not because founders woke up wanting it but because enterprise buyers refused to sign without it, and the certificate turned into a ticket to enter the room. The timeline on AI is faster. SOC 2 took five years to shift from optional to gating. ISO 42001 is making that shift in eighteen months. ISO 42001 is the first international standard for AI management systems, and it is quickly becoming part of enterprise vendor due diligence. While it is not a regulation, many organisations now use it to evaluate whether vendors have the governance needed to manage AI responsibly. The reason for the acceleration is not that buyers suddenly care more about governance. The reason is that non-compliance with the EU AI Act could lead to significant penalties, with fines reaching up to €35 million or 7% of global turnover, and legal risk comes from contracts, procurement exclusions, failed audits, misleading compliance claims, negligence allegations and regulatory duties under laws such as the EU AI Act, GDPR and sector-specific rules. EU AI Act violations can draw fines up to €35 million or 7% of global revenue. The buyer is not screening for excellence. The buyer is screening for transferable liability.

Achieving ISO 42001 certification typically takes 6 to 18 months, so organisations that begin building their AI governance program now will be better prepared for enterprise security reviews in 2026 and 2027. That is the number that ends the conversation in most vendor war rooms. Eighteen months is longer than the runway left on the current funding round. Six months is longer than the sales cycle the revenue plan assumes. ISO 27001-certified organisations can achieve ISO 42001 compliance up to 40% faster than those starting from scratch. If you already hold ISO 27001, the body of evidence for clauses 4 through 10 exists and has been audited. ISO 42001 borrows the same management-system skeleton as ISO 27001, the cycle of setting a scope, running a risk assessment, assigning ownership, treating risks, and reviewing continually, and points it at AI-specific concerns like model behaviour, data provenance, human oversight, and lifecycle control. In practice that means a company with a real ISO 27001 information security management system is not starting from zero, it is extending a system it already runs. The concepts of accountable owners, documented controls, and evidence of review carry straight across. The gap is in the AI-specific annex: the model risk register, the data governance log, the oversight mechanism, the bias assessment, the third-party model supplier due diligence. If that documentation does not exist when the RFP lands, the vendor is not in a six-month race. The vendor is explaining to the buyer why eighteen months is a reasonable timeline, while the certified competitor is uploading the certificate to the portal that afternoon.

The minimum requirements underpinning successful procurement bids are now explicit: board-approved AI policy (policy scoping is not valid unless formally signed at board level); named, auditable risk registers (every open AI risk must have a named, responsible owner, and a visible review history); supplier controls and flowdown (contracts must embed governance so that compliance does not stop at your firewall, it travels through every vendor tier); and versioned documentation (policies, registers, and reviews must be updated, version-controlled, and traceable). Procurement is not about promises, it is about proof. With ISO 42001, your bid survives only if you deliver live, auditable AI governance: board-signed policies, dynamic risk registers, and supplier controls on demand. "We will produce it later" means instant rejection. The buyer asking the question has already decided that a vendor without the evidence is a vendor who will fail the next audit. The decision is not technical. The decision is which vendor can be named in the board paper when the AI Office sends the first request for information, and which vendor makes that paper defensible.

As of April 2026, 78% of organisations have not taken meaningful steps toward EU AI Act compliance. Over 50% lack a basic AI inventory. The vendor who lands the contract will be the one who can show the buyer that they are not part of that 78%. Public estimates from certification bodies and press releases through April 2026 suggest more than 350 organisations globally hold ISO 42001 certificates, with the number rising sharply through 2026 as accredited certification bodies scale up audit capacity. Three hundred and fifty is a small number in a market of tens of thousands of AI vendors. It is also the number that determines which three vendors make it past the first procurement gate. The certificate is not proof that the AI system is safe, accurate, or unbiased. The certificate attests to a governance management system, not to any specific model's safety, accuracy, or data provenance. It is proof that the vendor has a system capable of answering the questions the regulator will ask, and that the system has been audited by an accredited third party within the last twelve months. That is what the buyer is purchasing.

August 2026 brings the next EU AI Act enforcement milestone. Organisations operating in the EU, or selling to anyone who does, are pulling certification forward to land before the deadline rather than during it. Audit slots in Q3 are filling now. The vendor who files the certification application in September will receive a slot in early 2027, after the enforcement window has opened and after the buyer has already signed with someone else. The one question I cannot answer from the buyer's side of the table is how many deals will move in August because one vendor had the certificate in May and the other did not. I can tell you the deals that stalled in June did so for exactly that reason.

Tarry Singh is the founder and CEO of Real AI (realai.eu), an enterprise AI advisory and deployment firm working with global enterprises on production agent systems, model risk, and AI sovereignty strategy. He also leads Earthscan (earthscan.io) for Energy AI, and is a founding contributor to the EU-funded HCAIM and PANORAIMA programmes for responsible AI education across European universities. He writes at tarrysingh.com.