The ISO 42001 alternative for small businesses

ISO 42001 is the international standard for AI management systems, and the substance is right: risk assessment, documented controls, ongoing monitoring, accountability. The certification process, for a 25-person firm, is not right — it costs $37,500–$85,000 in year one and roughly $115,000 over three years, and most of that spend goes to auditor fees and process overhead rather than the underlying governance discipline. What a small business actually needs is ISO-42001-shaped governance at SMB scale, without the certification.

What ISO 42001 actually requires

ISO 42001 defines an AI management system, or AIMS. The substance breaks into four working parts:

• A risk assessment. For every AI system in scope, an evaluation of what can go wrong, how likely it is, and what the impact would be. Updated on a defined cadence and after material changes.
• Documented controls. The specific policies, procedures, and technical mechanisms the firm uses to manage each identified risk. Written down. Reviewed.
• Ongoing monitoring and measurement. Evidence that the controls are actually operating — not just that they exist on paper. Metrics, logs, incident records.
• Management review and continuous improvement. A recurring formal cycle in which leadership reviews the AIMS, decides what to change, and documents the decision.

For a firm of any size operating AI in production, all four of those are the right things to do. A 25-person insurance agency running AI in the quote pipeline should have a risk assessment, documented controls, monitoring evidence, and a review cadence. The disagreement isn’t with the discipline. It’s with the paperwork surrounding the certificate.

What the certification costs, and what the cost buys

The $37,500–$85,000 year-one range covers, roughly: gap analysis by a consultancy ($10,000–$25,000), internal preparation time (often 200–400 person-hours, valued conservatively at $15,000–$40,000), the certification audit itself by an accredited registrar ($12,500–$20,000), and remediation of any nonconformities the audit finds. The ~$115,000 over three years adds surveillance audits (annual, ~$6,000–$12,000 each) and a re-certification audit in year three.

What that spend buys is the certificate. The governance work — the risk assessment, the controls, the monitoring — is what the firm builds during preparation. The certificate is a third-party attestation that the firm built it to the standard’s specification.

For a large enterprise, or for a firm selling AI-heavy services to enterprises that require the certificate as a procurement gate, the attestation is worth what it costs. For a 25-person firm serving other small businesses, the attestation is worth very little and the money would be better spent on the underlying controls.

Which parts a small firm actually needs

Almost all of the substance. Specifically:

• The risk assessment. Yes. A written document, reviewed annually and after any material change to an AI system in production. This is the input to almost every other decision.
• The documented controls. Yes. Written policies for evaluation, deployment, monitoring, incident response, vendor diligence, and record retention. These are also what a NAIC examiner, an E&O carrier, or a carrier partner will ask to see. See NAIC AI governance for a small insurance agency.
• The monitoring evidence. Yes. Actual alerts on actual production systems, not intentions. The reliability standard is the operational form of this.
• A review cadence. Yes. A quarterly review is realistic for a 5–50 person firm.

Which parts of the certification process are dead weight for a small firm

• Formal management review meetings on the ISO 42001 cadence. A firm with a five-person leadership team already reviews the business quarterly. A separate formal meeting with a documented agenda that mirrors the ISO clause structure is process overhead the size of the firm doesn’t support.
• Auditor fees. For a firm not being asked for the certificate by a buyer, the auditor is paid to produce an artifact nobody is asking to see.
• The gap analysis consultancy phase. For a firm with an existing operator on the AI workflows, the gaps are already visible.
• The formal nonconformity remediation and re-audit cycle. Useful when the certificate is the goal. Not useful when the goal is the underlying discipline.

What the Fractional AI Officer retainer covers of the substance

The Fractional AI Officer retainer covers the operational half of an AIMS on the workflows Phronimos runs: risk assessment per system, monitoring against the four silent-failure modes, incident response against a published reliability standard, quarterly review with the firm’s leadership, and an audit-ready evidence archive. What it does not cover is the certification audit or the auditor’s fees — because those are the parts a small firm does not need to buy.

If a firm later has a strategic reason to pursue the certificate — a specific enterprise buyer requiring it, a regulatory shift, an acquisition — the documentation from the retainer is the input a certification consultancy will use to prepare the audit. In that case the retainer has been paying for the substance all along, and the certification project is scoped as the layer of formal process on top.

The honest framing

ISO 42001 is a well-designed standard, and the standard document itself is worth reading if a firm’s leadership takes AI governance seriously. Certifying against it, at 25 people, is a category error — spending enterprise money on enterprise process to produce an enterprise artifact when what the firm needs is the underlying operational discipline. The alternative is not “skip governance.” It is: build the same controls the standard requires, at the scale the firm can actually operate, and document them well enough to satisfy a regulator, a carrier, or a serious buyer without the auditor in the middle.

---

Last reviewed: 2026-08-13.