From a 20-person consultancy to Oracle: who is really getting ISO 42001
AI-assisted text, reviewed by a person at Heedward.
Our estimate: around 500 companies in the world hold ISO/IEC 42001. We found 230 of them and read every announcement. Here is what we learned.
You might be surprised how small the number is. By our estimate, more or less 500 companies in the world hold an ISO/IEC 42001 certificate. The standard was only published in December 2023, but still: 500, worldwide.
That's our guess, not a count, and here is how we got there. The ISO Survey, which is the closest thing to an official number, counted 271 accredited certificates at the end of 2025. Then we went looking ourselves. In two days of searching (with AI research agents doing most of the reading) we found 230 companies that say in public they hold the certificate, and we stopped before we ran out of names. More than eighty of those announcements are from 2026, after the survey's cut-off. Our search found roughly half of what the survey counted for 2025, so the new ones this year are probably about twice what we saw. Add the certificates the survey never sees, and you land somewhere around 500.
Then we read all 230 announcements. A few things stood out.
230 ISO/IEC 42001 certificate holders at a glance
companies worldwide hold ISO/IEC 42001, by our estimate
ISO Survey: 271 accredited certificates at the end of 2025. We found 230 holders in two days of searching, more than 80 of them announced in 2026.
- 6 in 10sell software, cloud or IT services
- 18are HR and recruitment vendors
- 5are banks or insurers
people: the smallest and largest holders we could size
Log scale. Sizes as stated on the companies' own pages.
announcements claim to be first at something
of the first holders we found also hold ISO 27001
An AI check of public trust pages, not yet verified source by source.
- 1 in 8say who accredited their certifier
- under 1 in 4mention the EU AI Act at all
- 1 in 10say what the management system actually changed
The numbers as a table
| What we counted | Count |
|---|---|
| Holders worldwide, our estimate | around 500 (roughly 400 to 700) |
| Companies announcing an ISO/IEC 42001 certificate, found by us | 230 |
| ISO Survey 2025, accredited certificates at 31 Dec 2025 | 271 |
| Our announcements dated 2026 | 85 |
| Sell software, cloud or IT services | 140 (61%) |
| HR and recruitment vendors | 18 |
| Banks or insurers | 5 |
| Smallest and largest sized | about 20, 50+, 84 … 141,000 people |
| Announcements claiming to be first (of 203) | 140 (69%) |
| Also hold ISO 27001, first 40 holders (AI check) | 34 |
| Name the certifier's accreditation body (of 228 pages) | 28 (12%) |
| Mention the EU AI Act (of 203) | 46 (23%) |
| Describe a concrete change (of 149 coded) | 14 (9%) |
Mostly software, and not only the giants
About six in ten of the companies sell software, cloud or IT services to other businesses. The big names are all there - Microsoft, AWS, Google Cloud, IBM, Anthropic, OpenAI - and so are KPMG, BCG and Cognizant.
What surprised us more is the other end of the list. Among the holders we could size from their own pages there's a consultancy of about 20 people, a security firm with just over 50 consultants and a legal-tech scale-up of 84. Oracle, for comparison, has about 141,000. So you don't need a compliance department to get there.
Banks are almost missing: only five of the 230. Eighteen more sell software to banks, insurers and payment firms. Our reading (which this list can't prove) is that the supplier gets certified because its customers ask for it.
The hiring software is there
Eighteen companies on the list sell HR and recruitment software or services: Workday, Greenhouse, Eightfold, SmartRecruiters, Cornerstone and others. Their AI screens applicants, runs interviews and matches skills to jobs, which is exactly the kind of use the EU AI Act lists as high-risk. PageUp, one of these vendors, says its customers "need evidence rather than assurances." A certificate doesn't make a hiring tool meet the AI Act. It's a fairly good start on that evidence, though.
It bends to fit
One thing the list shows quite well is how flexible the standard is. It's written for organisations of any size, and you decide the scope yourself. The scopes we read go from one feature of one product, or one AI system in one plant, all the way to a whole company. One IT services firm is certified purely "as an AI User" of Microsoft Copilot - it doesn't build any AI of its own.
The same goes for the controls. There are 38 of them, and you don't have to apply all of them. You pick the ones your risks call for and write down why you left out the rest. So a 20-person consultancy and Oracle follow the same standard and end up with very different systems, which is how it's meant to work.
More than a badge
The certificate is the visible part. It tells your customers you take responsible AI seriously, and it looks good on a trust page. The real value is in the management system behind it. You know which AI you use and where. You assess the risks, and the impact on people, before something ships. Every decision has an owner. And audits look for gaps on a regular basis, so you (hopefully) find them before a customer or a journalist does.
It won't make you immune to problems, but it makes them less likely and easier to handle. A few holders say this quite openly. Pinpoint says it "helped turn our existing practices into something measurable and repeatable". Genesys says it "helps to accelerate vendor selection and procurement". Only about one in ten announcements are that specific, though. Most stick to "responsible AI".
Already on ISO 27001? Look here next
Of the first 40 holders we found, 34 also hold ISO 27001. We got that from an AI check and haven't verified it source by source yet, but we wouldn't call it a coincidence. ISO/IEC 42001 follows the same management-system structure as 27001. If you already run 27001, you have the scope, the internal audits, the management reviews and the habit of fixing what an audit finds. What's new is the AI part: an AI policy, AI risk and impact assessments, and a set of AI-specific controls. Kustomer puts it plainly: "We treat ISO 27001, 27701, and 42001 as an integrated management system."
Everybody's first
And then there are the "firsts". Seven in ten announcements claim to be first at something - first in a country, first in a sector, first client of a certifier in a region. Two IT services firms each announced they were the first in their industry, four months apart. The second one added the word "accredited", which we suppose settles it.
Only about one in eight say who accredited their certifier, and fewer than one in four mention the EU AI Act at all. The more careful ones say what Dynatrace says in its FAQ: "Certification is not a statement of conformity with any specific law."
So, who's next?
If you already hold ISO 27001 and your product uses AI, what's stopping you from looking at 42001? And if you've been through it, was it worth it? We're genuinely curious.
How we counted
We searched the public web on 29 September and 7 October, and counted a company only when we could open a page saying it holds the certificate. Another 34 were reported but we couldn't confirm them. On 16 October AI agents read the 230 pages (228 loaded) and recorded each one's reasons, claims and size. We checked every quote and size used here against its source. This is what we found, not a census. The ISO Survey figure is from its 2025 results as published by a certification body. The estimate of around 500: 271 accredited certificates at the end of 2025, plus about twice the 85 we found dated 2026 (we saw roughly half of the 2025 ones), plus certificates from bodies that don't report to the survey. A rough range is 400 to 700.