ISO 42001 Certified Companies: The US List, Sourced

As of October 2026, 40 companies that sell in the US say on their own pages or in their own press releases that they hold ISO/IEC 42001 certification. They run from Amazon Web Services (announced 25 November 2024) to Coretek (1 October 2026). Each name below links to that primary source, and each row gives the certified scope, whether a certification body is named and the date.

A certificate covers a defined scope. “Certified” applies to the products, services or AI management system the company names, not automatically to everything it sells. What every entry had to put in place is set out in what ISO 42001 requires of an organization.

What the 40 sources show, at a glance:

• Sectors: 10, led by enterprise and customer experience software (9) and cloud and AI platforms (7).
• Certification body: 18 of 40 sources name it. Six also name the accreditation body, five of them ANAB.
• Scope: 24 name specific products, services or AI roles. The other 16 describe only “the AI management system”.
• Timing: 3 announcements in 2024, 16 in 2025 and 20 in 2026 so far. One page gives no date.

The US list of ISO 42001 certified companies, with primary sources

The table lists every company selling in the US that we could verify as ISO/IEC 42001 certified on a primary source, grouped by sector and sorted by date within each sector. The company name is the link to that source.

Source: each company’s own announcement, trust or compliance page, or certificate, linked on the company name and opened in October 2026. Twelve sources are press releases that companies issued through a wire service. “Named on source” means the company names the certification body that issued or audited the certificate; follow the link to see it. Dates are announcement dates unless the row says otherwise.

Two entries need a note. UiPath’s post, dated 8 October 2025, says certification was achieved by September 2025. Zendesk’s announcement shows only a “last updated” date of 25 September 2025.

What the 40 ISO 42001 certificates have in common

Most ISO 42001 certificates on this list belong to software vendors that put AI in front of business customers. Cloud platforms, enterprise software, security and HR technology together make up 23 of the 40 entries.

ISO/IEC 42001 certified companies on the AI Training Skool US list by sector, October 2026: enterprise and customer experience software 9, cloud and AI platforms 7, professional and IT services 5, cybersecurity 4, healthcare and life sciences 4, HR technology 3, marketing and ad tech 3, finance software 2, legal and information services 2, transportation technology 1

Source: AI Training Skool ISO 42001 certified companies dataset, 40 entries.

Disclosure varies more than the headlines suggest. Only 18 of the 40 sources name the certification body, and only six say which accreditation body stands behind it. Five of those six name ANAB, the US accreditation body; Microsoft names the International Accreditation Service. Thomson Reuters is the one company in the set whose primary source is the certificate itself, with a certificate number and an expiry date.

Scope disclosure splits the same way. Twenty-four sources name products, services or the AI roles covered, such as Amazon Bedrock, Salesforce’s Agentforce or CrowdStrike’s Falcon platform. Sixteen say only that “the AI management system” is certified, which tells a buyer little until they see the scope statement on the certificate.

Adoption is recent. Three of these announcements date from 2024, 16 from 2025 and 20 from the first nine months of 2026. No bank or insurer is on the list yet; the two finance entries are software vendors.

Why an ISO 42001 certificate covers a scope, not a whole company

An ISO 42001 certificate covers the AI management system scope the company defined, and nothing outside it. ISO/IEC 42001 clause 4.3 requires the organization to determine the boundaries of its AI management system and keep the scope as documented information. The standard’s own definition of “organization” says that in a larger entity, the term “refers only to the part of the larger entity that is within the scope” (ISO/IEC 42001:2023, definition 3.1, official preview). Within that scope, the Annex A controls an organization applies are recorded in its Statement of Applicability, covered in writing an ISO 42001 SoA.

The list shows what that means in practice:

• Amazon Web Services announced certification for four services: Amazon Bedrock, Amazon Q Business, Amazon Textract and Amazon Transcribe.
• Microsoft’s July 2025 announcement covered Azure AI Foundry Models and Microsoft Security Copilot. Its Microsoft Learn ISO/IEC 42001 page, updated September 2026, lists more services, including GitHub Copilot, Microsoft Copilot and Copilot Studio.
• Oracle holds five separate AI management system certifications, one each for OCI AI services, Oracle Health, Oracle Life Sciences, Oracle SaaS on OCI and NetSuite.
• Zendesk names two recent acquisitions that sit outside its scope.
• Eightfold AI defines scope by role: developer of AI systems, provider of AI-enabled services and consumer of third-party AI.

So “Is this company ISO 42001 certified?” usually has a scoped answer: yes, for the systems named on the certificate. A certificate also has a life cycle. It is issued after the Stage 1 and Stage 2 audits, maintained through annual surveillance audits and renewed at recertification in year three. Preparing for those audits means building an AIMS step by step, and that guide also covers the Stage 1 and Stage 2 audits.

How to verify a company’s ISO 42001 certification in five steps

You verify ISO 42001 certification by reading the certificate and its scope, then confirming the certification body is accredited for ISO/IEC 42001. A press release alone is a claim, not proof.

1. Ask for the certificate. It should show the certified organization, the scope statement, a certificate number, issue and expiry dates, and the certification body. Thomson Reuters publishes its certificate: number CERT-000611, issued 12 March 2025, expiring 11 March 2028.
2. Match the scope to what you buy. If the product you are buying is not in the scope statement, the certificate does not cover it.
3. Check the certification body’s accreditation. In the US, the ANAB AIMS accreditation programme has accredited certification bodies for ISO/IEC 42001 since January 2024. Our guide to ISO 42001 accredited certification bodies and how to check them shows which register to use for each claim.
4. Search the certificate. IAF CertSearch offers a free search of accredited management system certificates. The database keeps the name of the International Accreditation Forum (IAF), which merged with ILAC into the Global Accreditation Cooperation on 1 January 2026. If a certificate is not there, ask the certification body to confirm it.
5. Check that it is current. Ask for the date of the last surveillance audit. A certificate that has expired, or that the certification body has suspended or withdrawn, no longer counts.

For a supplier, these five checks belong in your vendor due diligence file, next to the answers they give about their AI systems.

Who issues ISO 42001 certificates, and who does not?

Accredited certification bodies issue ISO 42001 certificates to companies. ISO does not. ISO’s statement on certification says ISO “does not perform certification or issue certificates”.

Certification bodies are accredited to audit management systems under ISO/IEC 17021-1, and ISO/IEC 42006:2025, published in July 2025, adds requirements specific to bodies that audit and certify AI management systems. The accreditation chain runs from an accreditation body such as ANAB, through the certification body, down to the certificate.

Some sources on the list do not say who issued the certificate. Google Cloud’s compliance page, for example, says its services are “certified as ISO/IEC 42001:2023 compliant” but names no certification body and gives no date. In that case, ask the company for the certificate.

A company certificate is also different from a person’s credential. A professional who passes a Lead Implementer or Lead Auditor exam holds a personal certificate, which is checked and kept current a different way, as set out in our guide to the ISO 42001 certificate, badge and renewal. Whether a personal credential is worth earning is a separate question, weighed in the value of an ISO 42001 credential in the US job market.

Companies people search for that are not on this list

Some companies that people search for with “ISO 42001” are not on the list because, in October 2026, their own pages did not state that they hold the certification.

• Zscaler: its compliance center did not list ISO/IEC 42001 among its certifications.
• OneTrust: we found pages about helping customers prepare for ISO 42001, but no statement that OneTrust itself holds the certification.
• OpenAI: its security page says OpenAI “maintains an ISO/IEC 42001:2023 AI Management System” for its consumer and business AI products and models, as an AI producer and AI provider, and its trust portal lists ISO/IEC 42001:2023 under compliance. Neither page, as worded when we checked, says the system is certified or names a certification body, so OpenAI stays off the list until one does. If you buy from OpenAI, ask for the certificate.

Absence from this list is not proof that a company lacks certification. A company may hold a certificate and not publish it, or publish it in a portal behind a login. If a supplier matters to you, ask them directly, and record the answer in your AI vendor risk assessment.

Does a company need ISO 42001 certification?

No US law requires a company to hold ISO/IEC 42001 certification. Texas TRAIGA, Colorado SB 26-189, California SB 942 and AB 2013, and the NIST AI Risk Management Framework do not require it. Certification is voluntary, and companies pursue it mostly because customers ask for evidence of AI governance.

The announcements on this list say as much. Microsoft says its certification “assists customers with supporting their own compliance efforts”. If you are weighing whether to start with NIST AI RMF or ISO 42001, the comparison covers what each one gives you, including under Texas TRAIGA.

A certified AI management system also needs people to run it: someone to keep the AI system register, run impact assessments and prepare for each surveillance audit. That work shows up in the skills US AI governance postings list, and pay for ISO 42001-related roles is covered in our salary analysis.

How this list is built and kept current

An organization is on this list only if we opened its own primary page and that page states it holds ISO/IEC 42001 certification. Primary pages are the company’s trust or compliance page, newsroom, blog, investor news, a press release it issued, or the certificate.

What we left out:

• Organizations named only on third-party lists, in news coverage or in social media posts. Third-party lists helped us find candidates; none is used as a source.
• Statements of “alignment”, “readiness” or work toward certification without a stated certificate.
• Organizations with no evident US sales or operations.
• Certification bodies, which certify others, unless they state their own certification.

The list relies on what each company says about itself. Apart from Thomson Reuters, we did not see the certificates, so use the five verification steps before you rely on any entry.

The list is not exhaustive. Last checked: 4 October 2026. AI Training Skool rechecks every entry and adds new primary sources monthly, with the next check in early November 2026. To suggest an addition or correction, email support@aitrainingskool.com with a link to the company’s own page.

Frequently Asked Questions

Is Microsoft ISO 42001 certified?

Yes, for named services. On 17 July 2025, Microsoft announced ISO/IEC 42001:2023 certification for Azure AI Foundry Models and Microsoft Security Copilot, issued by a certification body accredited by the International Accreditation Service. Microsoft’s compliance documentation, updated September 2026, lists further services, including GitHub Copilot and Microsoft Copilot. Check the current certificate on Microsoft’s Service Trust Portal for the exact scope.

Is AWS ISO 42001 certified?

Yes. On 25 November 2024, Amazon Web Services announced ISO/IEC 42001 accredited certification for four services: Amazon Bedrock, Amazon Q Business, Amazon Textract and Amazon Transcribe. AWS said the certification body was accredited by ANAB, the ANSI National Accreditation Board. Other AWS services are not covered unless a later certificate adds them, so check the scope for the service you use.

Does Google Cloud have ISO 42001 certification?

Google Cloud’s compliance page states that Google Cloud, Google Workspace and Gemini (App) are certified to ISO/IEC 42001:2023. It lists in-scope services such as Document AI, Gemini Enterprise and Speech-to-Text. The page gives no certification date and does not name the certification body, so ask Google for the certificate to confirm the issuer and exact scope.

Is Workday ISO 42001 certified?

Yes. Workday announced ISO/IEC 42001 certification on 12 June 2025, citing its responsible AI governance program, and named the firm that assessed it. Workday is one of three HR technology companies on the AI Training Skool list, alongside Eightfold AI (August 2025) and Greenhouse (February 2026). For hiring tools, check that the certificate scope includes the product you use.

How can I check if a company is ISO 42001 certified?

IAF CertSearch is a public database of accredited management system certificates and is free for basic searches. If a certificate is not there, ask the company for its ISO/IEC 42001 certificate and read the scope statement, certificate number and expiry date. Confirm that the certification body is accredited for ISO/IEC 42001; in the US, ANAB has run an accreditation program since January 2024. Also ask when the last surveillance audit took place.

Which AI model developers are ISO 42001 certified?

Anthropic announced accredited ISO/IEC 42001:2023 certification for its AI management system on 13 January 2025. IBM announced certification for the AI management system behind its Granite models on 1 October 2025. Both named an ANAB-accredited certification body. OpenAI says it maintains an ISO/IEC 42001:2023 AI management system, but in October 2026 its pages did not state certification.

How many companies are ISO 42001 certified worldwide?

We found no official published count of ISO/IEC 42001 certificates. Company announcements give rough markers only: in April 2026, Doppel said it was among the first 350 organizations worldwide to achieve the certification. The AI Training Skool list holds 40 companies that sell in the US and state certification on their own pages.