AI governance has moved from conference talk to audit evidence. A year ago, most conversations about ISO/IEC 42001, the international standard for AI management systems, were about what it might mean. In 2026, enterprise buyers are asking for the certificate in vendor questionnaires, and the number of organisations holding one has grown sharply.
An independent tracker run by ISO42k, which counts publicly announced ISO 42001 certifications, gives the clearest picture yet of where the market stands. Here is what its data, current to 18 October 2026, tells us, and what it means if you lead security, compliance or AI work at an Indian organisation.
ISO 42001 certification in 2026: the headline numbers
- 223 organisations have publicly announced ISO 42001 certification, across 29 countries.
- 116 of those certifications came in 2026, up from 87 in 2025 and 19 in 2024.
- The busiest quarter so far was Q1 2026, with 41 announced certifications, and the pace has held at about 35 per quarter since.
- 27 certification bodies have issued publicly disclosed certificates.
In other words, more organisations announced ISO 42001 certification in the first nine months of 2026 than in all the years before it combined.
India is second only to the United States
The United States accounts for 146 of the 223 certified organisations, about two-thirds of the total. India is in second place with 11, ahead of the United Kingdom (9), Australia (6) and Canada (5).
Two things are worth reading into that figure. First, the tracker relies mainly on English-language announcements and counts organisations by where they are headquartered, so India’s real share of certified AI operations is probably higher: many global firms run their AI engineering from Indian delivery centres and GCCs. Second, 11 is still a small number for a country with India’s IT services and SaaS footprint. The organisations certifying now are early movers, and that early-mover window is still open.
Who is getting certified, and why
Enterprise software companies make up the largest group, at 43% of certified organisations. Professional services firms follow at 15%, then cloud and AI platform providers at 9%, cybersecurity firms at 8% and GRC and compliance firms at 6%.
The pattern points to the main driver: customers. Companies that sell software and services to large enterprises are being asked to prove that their AI systems are governed, tested and monitored. An ISO 42001 certificate is becoming the shorthand answer in security reviews and RFPs, much as ISO 27001 did for information security a decade ago.
For Indian IT exporters, SaaS companies and GCCs, the commercial logic is the same. If your clients in the US, UK or EU are buying AI-enabled services from you, expect them to ask how you manage AI risk, and expect ISO 42001 to be one of the ways they want that evidenced.
Which certification bodies are issuing ISO 42001 certificates
Among organisations that named their certifier, Schellman issued about a third of certificates, followed by A-LIGN, SGS and BSI. The top three together account for more than half of disclosed certifications.
When you choose a certification body, check that it is accredited for ISO/IEC 42001 by a recognised accreditation body. A certificate’s value in a client review depends on who issued it.
Read the numbers with care
The tracker is open about its limits, and they matter:
- It counts only publicly announced certifications. Many organisations certify quietly, so the real total is higher.
- Announcements lag certification, so the most recent quarters are still filling in.
- Earlier years were collected after the fact and may be undercounted.
- Certificates are not checked against accreditation registries.
Even with those caveats, the direction is clear: ISO 42001 certification is growing fast, and it is concentrated in exactly the sectors where Indian companies compete globally.
What this means for Indian organisations
If you are considering ISO 42001, the work follows a familiar management-system path. The difference is that the risks you are managing are specific to AI. For a clause-by-clause walkthrough of the standard, see What Is Inside ISO 42001?, and for budgets and timelines, see ISO 42001 Certification in India: Cost and Timeline. A practical sequence looks like this:
- Build an AI inventory. List the AI systems you develop, buy or embed, including generative AI tools used inside the business.
- Define the scope of your AI management system (AIMS). Decide which products, teams and locations it will cover, and your role for each system: developer, provider or user.
- Assess AI risk and impact. Run AI risk assessments and AI system impact assessments covering fairness, transparency, data quality, security and effects on people.
- Implement the Annex A controls that apply, and record your choices in a Statement of Applicability.
- Connect it to what you already have. If you hold ISO 27001 or are working on DPDP Act compliance, much of your governance, risk and documentation can be reused.
- Build in-house competence. Someone inside the organisation needs to understand the standard well enough to run the AIMS and audit it.
- Run an internal audit and management review, then go for the Stage 1 and Stage 2 certification audits.
How Pricoris can help
Pricoris supports organisations at both ends of that journey.
Training. Our ISO/IEC 42001 Lead Implementer cum Lead Auditor course is one combined programme that awards both certificates. It runs over 4 days of live, instructor-led sessions, led by Sandhya Khamesra, former COO of BSI India. The fee is ₹32,500 + GST, and the exam is included with one free retake. Upcoming batches include 21, 22, 28 and 29 November 2026 and 9, 10, 16 and 17 January 2027. See all dates on our training calendar.
Consulting. If you are preparing your organisation for certification, our ISO 42001 consulting team can help with scoping, AI risk and impact assessments, control implementation and audit readiness.
The organisations certifying today are setting the standard their clients will expect from everyone else. If AI is part of what you sell, now is a good time to get ahead of that question.
Talk to us about ISO 42001 training or certification
Source: ISO42k, “State of ISO 42001 Certification”, data as of 18 October 2026, iso42k.com/state-of-iso-42001. Figures cover publicly announced certifications only.