AI Governance Certification: Company Certificates vs Professional Credentials

"AI governance certification" means two different things. For organizations, the main certifiable standard is ISO/IEC 42001, audited by an accredited certification body; the NIST AI RMF has no certification, and SOC 2 is an attestation, not a certification. For individuals, the best-known credentials are the IAPP's AIGP and ISO 42001 Lead Implementer or Lead Auditor courses from providers such as PECB and BSI.

If a customer asked "are you certified?", they almost always mean the organizational kind. If you are hiring or building internal skills, you want the individual kind. This guide separates the two.

Organizational certification: what your customers are asking for

ISO/IEC 42001 is the main certifiable standard

ISO/IEC 42001:2023, published in December 2023, sets requirements for an AI management system (AIMS). It is the first international management-system standard for AI that can be certified. Any organization that develops, provides, or uses AI can be certified, regardless of size or sector.

How it works:

• An accredited certification body runs the audit. In the US, accreditation is commonly through ANAB; in the UK, through UKAS. ISO/IEC 42006 (2025) sets requirements for bodies that audit and certify AI management systems.
• Stage 1 reviews your documentation and readiness. Stage 2 tests whether the system is implemented and effective.
• The certificate is valid for three years, with annual surveillance audits, then recertification.
• Most organizations need the AIMS running for a period, commonly around three months of records, including at least one internal audit and management review, before Stage 2.

The full path is in how to get ISO 42001 certified, and costs are in the ISO 42001 certification cost guide.

NIST AI RMF: no certification

The NIST AI Risk Management Framework (AI 100-1, January 2023) is voluntary and free. NIST does not certify anyone against it. You can align your practices with it, document that alignment, and some third parties will assess you against it, but no one can issue an official "NIST AI RMF certified" status. Treat any vendor claim to the contrary carefully. NIST publishes crosswalks to ISO/IEC 42001, which is one reason companies often use the RMF for risk practice and ISO 42001 for the certificate. See ISO 42001 vs NIST AI RMF.

SOC 2: attestation, not certification

SOC 2 is an attestation report from a CPA firm against the AICPA Trust Services Criteria. It is widely requested in US B2B sales, but it is not a certification and it does not address AI-specific governance such as impact on individuals, data provenance, or life-cycle controls for models. Some companies add AI-related controls to their SOC 2 scope, which can help, but it is still a security attestation. ISO 42001 does not replace SOC 2 or ISO 27001 either; they sit side by side. See ISO 42001 vs ISO 27001 vs SOC 2.

What about the EU AI Act?

The EU AI Act includes conformity assessment for high-risk AI systems, which is a legal process for specific systems, not a general governance certificate. As of October 2026, obligations for high-risk systems listed in Annex III apply from December 2, 2027, following the Digital Omnibus on AI. An ISO 42001 certificate does not equal AI Act compliance, though the management system supports it. This is not legal advice.

Individual credentials: building your team's skills

These certify a person's knowledge. They are useful for hiring, for the person who will own your AIMS, and for internal auditors. None of them certifies your company.

IAPP AIGP (Artificial Intelligence Governance Professional)

The IAPP AIGP is a professional credential from the International Association of Privacy Professionals. According to the IAPP, it covers foundations of AI systems and their impacts, how laws and frameworks apply to AI, the AI life cycle and AI risk management, and implementing responsible AI governance. The exam is based on a published Body of Knowledge and exam blueprint that the IAPP updates periodically. Because it spans law, frameworks, and risk practice, it suits privacy, legal, and governance leads. The IAPP's AIGP candidate handbook lists no formal prerequisites; check the IAPP's certification process page for current exam format, fees, and maintenance requirements.

ISO 42001 Lead Implementer

Lead Implementer courses teach how to plan, build, and maintain an AIMS under ISO 42001. PECB's ISO/IEC 42001 Lead Implementer is a five-day course with a three-hour exam, according to its course brochure. PECB grants different credential levels depending on professional and AI-specific experience, so passing the exam is not the whole requirement for the full "Lead" title. Best for the person who will own your AIMS day to day.

ISO 42001 Lead Auditor

Lead Auditor courses teach how to plan and run audits of an AIMS, following the audit principles in ISO 19011. BSI's ISO/IEC 42001 Lead Auditor course recommends prior knowledge of ISO 42001 and audit experience, and PECB offers a Lead Auditor track as well. Course length and format vary by provider and region. Best for internal auditors and people who will audit AI suppliers.

Other training providers offer similar courses. Prices vary by provider, region, and delivery format, so compare current listings directly.

Comparison table

Credential	Who it certifies	Issued by	Certifiable?	What it proves	Typical audience
ISO/IEC 42001 certificate	Organization	Accredited certification body	Yes, 3-year cycle with annual surveillance	Your AI management system meets the standard	Customers, procurement, regulators
NIST AI RMF	Neither	NIST publishes it; no certifier	No official certification	Alignment only, self-declared or third-party assessed	Internal risk and governance teams
SOC 2 report	Organization (service controls)	Licensed CPA firm	Attestation, not certification	Controls meet Trust Services Criteria over a period	US B2B customers' security teams
IAPP AIGP	Individual	IAPP	Yes, personal credential	Knowledge of AI governance, law, and risk	Privacy, legal, governance professionals
ISO 42001 Lead Implementer	Individual	Training/personnel certification providers (e.g. PECB)	Yes, personal credential	Ability to build and run an AIMS	AIMS owners, compliance leads, consultants
ISO 42001 Lead Auditor	Individual	Training/personnel certification providers (e.g. PECB, BSI)	Yes, personal credential	Ability to audit an AIMS	Internal auditors, supplier auditors, certification auditors

Which do you need?

Work through these in order.

1. A customer or prospect asked "are you certified?" or sent an AI governance questionnaire. You need organizational evidence. If they named ISO 42001, plan for certification. If they only want answers, a documented AI governance framework aligned to ISO 42001 may satisfy them for now, but expect the certificate question to come back at renewal. Start with a gap assessment to size the work.

2. You already have SOC 2 or ISO 27001. Good foundation, not a substitute. ISO 42001 can share your document control, internal audit, and management review with ISO 27001 as one integrated management system, which shortens the path. The AI-specific pieces, such as impact assessment, data provenance, and life-cycle controls, are new work.

3. Your customers reference NIST, or you want a common risk vocabulary. Align with NIST AI RMF and document the mapping. If you also need a certificate, use ISO 42001 as the management system and map NIST functions onto it.

4. You need someone internal to own AI governance. Fund a credential for that person. AIGP suits a privacy or legal background; ISO 42001 Lead Implementer suits a compliance or security background who will run the AIMS. Many owners eventually do both.

5. You need an internal audit function for the AIMS. ISO 42001 requires internal audits by people who are objective about what they audit. Train an internal auditor (Lead Auditor course) or outsource it, for example through an AIMS retainer.

Auditor's note: In audits, the most common gap we look for is a confident claim that outruns the evidence. Sales decks that say "NIST certified," a trust page that lists an employee's AIGP as if it were a company certificate, or "ISO 42001 compliant" with no certificate behind it. Procurement reviewers check, and a vague claim costs more credibility than an honest "we are aligned with NIST AI RMF and pursuing ISO 42001, target date Q2."

How TrustAIMS helps

TrustAIMS is an advisory firm founded by former Big Four auditors. We help you prepare for ISO 42001 certification with fixed-fee work: a gap assessment from $12,500 in about two weeks, certification readiness from $35,000 over roughly 10 to 14 weeks, and an AIMS retainer from $2,500 per month. We do not issue certificates. Independence rules mean the certification body that audits you cannot also consult for you, so you will choose an accredited body separately and we support you through Stage 1 and Stage 2.

Not sure where you stand? Take the free ISO 42001 readiness assessment.