HOW WE ENGAGE

The standard is the same. The way we work with you is not.

ISO/IEC 42001 obligations do not change with company size. But how a startup absorbs them is not how a scaleup operates, and not how an enterprise organizes. We have three engagement models, designed for the realities of each stage.

A common assumption in certification is that the methodology should be the same regardless of client size. Same audit duration, same documentation requirements, same fee structure. Legacy certification bodies operate this way because their processes were standardized for an era when most clients were enterprise.

That standardization creates two problems. Smaller companies pay for overhead they do not need. Larger companies receive engagement that does not match their internal complexity. Both end up with a certification process that feels misaligned to their reality.

The standard, ISO/IEC 42001, does not change. But the way the certification body works with the client should.

THREE ENGAGEMENT MODELS

Startup

For early-stage AI vendors and SaaS companies up to Series A.

What this looks like

Focused engagement, accelerated timelines, fixed fees designed for early-stage budgets. Documentation requirements scaled to actual operational maturity, not to enterprise expectations. The goal is to provide certification that is real, accredited, and defensible, without imposing the overhead of an enterprise audit on a 30-person team.

When this works

When the certification is needed to close enterprise pilots, satisfy investor diligence at the next round, or differentiate in a competitive vendor selection. When the company has clear ownership of AI governance and can move fast on remediation.

Typical timeline: 8 to 14 weeks from kick-off to Stage 2 audit.

Scaleup

For growth-stage AI vendors, mid-market SaaS, and scaling AI deployers.

What this looks like

Structured engagement that recognizes the company is no longer a startup but is not yet operating with enterprise complexity. Multiple stakeholders involved, integration with existing certifications (often ISO/IEC 27001), and a remediation plan that fits the cadence of a scaling company.

When this works

When the company is preparing for a major commercial milestone, IPO, large enterprise deals, or international expansion. When existing risk and compliance functions need to integrate AI governance without disrupting their current operations.

Typical timeline: 12 to 20 weeks from kick-off to Stage 2 audit, depending on existing certifications and scope.

Enterprise

For large corporations, financial institutions, public bodies, and multi-jurisdictional operators.

What this looks like

Structured engagement designed for institutional complexity. Multiple business units, multiple jurisdictions, integration with existing management systems, alignment with sectoral supervisors. Phased certification scope where appropriate, allowing the institution to certify a defined perimeter first and expand.

When this works

When the institution operates under multiple regulatory regimes, when AI governance has to coordinate across functions and geographies, and when board-level visibility into the certification process is required.

Typical timeline: 16 to 32 weeks from kick-off to Stage 2 audit, depending on scope and integration with existing certifications.

WHAT IS CONSTANT

What is constant across all three

The accreditation does not change. The auditor competence does not change. The certificate issued is the same accredited certificate, recognized internationally. What changes is the operating model around the audit, not the audit itself.

This is the structural difference between Zertia and the legacy certification bodies that apply enterprise methodology to all clients. The standard is the same. The engagement is fitted to the reality.

ANAB-accredited · UKAS in process · ENAC in process · AIUC-1 European authorized auditor · EU AI Pact signatory

WHERE TO START

Talk to us about your context.

A 30-minute conversation to understand your stage, your sector, and your timeline. We tell you which engagement model fits, with no commercial pressure.

Book a conversation