ISO 42001 procurement: the evidence

The chain that explains the number

Three things have to exist before a buyer can put a certification in a tender: the standard, a rulebook for the bodies that audit against it, and an accredited body willing to issue it. For ISO 42001 the last of those arrived in the UK in January 2026.

The load-bearing sentence. The single UK notice naming ISO 42001 was published 18 May 2026 — four months after the first UK-accredited certificate could exist at all, and ten months after the standard governing the certifiers was published. A buyer cannot demand a certificate nobody in the country is accredited to issue. That is the mechanism, and every link in it has a primary source.

Four things it is tempting to say here, and why each is wrong

These matter because they are what the most-linked pages on this topic say, and a reader arriving from one of them should be able to see the correction rather than a flat contradiction.

We have no source explaining why BSI published in November, and we are not guessing at one. The two dates are recorded, the reason for preferring the UKAS date is given, and that is as far as the evidence goes.

The AI management system standard, and what it certifies

The most consequential misunderstanding on this topic is not about dates. It is about scope: what the certificate is a certificate of.

ISO/IEC 42001:2023 certifies an artificial intelligence management system — the organisational apparatus by which a company decides what AI it will build, how it assesses risk, who is accountable, and how it reviews what it has deployed. [1] It is a management-system standard in the same family as ISO 9001 for quality and ISO/IEC 27001 for information security, and it works the same way: an auditor examines your processes and your records.

It does not certify a model. It does not evidence that any particular algorithm has been tested, that a system is accurate, or that a specific output is fair. An organisation can hold a valid ISO 42001 certificate and ship a bad model, in the same way an ISO 9001 holder can ship a bad product — the standard says the process exists and is followed, not that the output is good.

This matters commercially in both directions. If you are selling, claiming that the certificate demonstrates model quality is a claim the standard will not support and an informed evaluator will discount. If you are buying and you actually want assurance about a model, the certificate is the wrong instrument and you should be asking for testing evidence, not a certificate number.

The UK plan to put AI governance into procurement, and its cancellation

This is the strongest fact on the page, and it is the one most competing content gets backwards — because the intention is easy to find and the reversal is not.

DSIT built AI Management Essentials, a self-assessment tool distilled from ISO/IEC 42001, the EU AI Act and the NIST AI Risk Management Framework, and consulted on it between 6 November 2024 and 29 January 2025. The report Assuring a Responsible Future for AI, published 6 November 2024, states both the lineage and the intent verbatim:

“Drawing on key principles from existing AI-related standards and frameworks — including ISO/IEC 42001 (Artificial Intelligence - Management System), the EU AI Act, and the NIST AI Risk Management Framework — AI Management Essentials will provide a simple, free baseline of organisational good practice”, and “In the medium term we are looking to embed this in government procurement policy and frameworks to drive the adoption of assurance techniques and standards in the private sector.” [6]

That quote must never be published without what follows it. It is a November 2024 aspiration that a February 2026 decision explicitly reversed, and quoting the intent alone — which several competing pages do — is the single easiest way to be wrong on this topic.

The government response, published 6 February 2026:

“DSIT will not be publishing AIME and therefore will not be making it a requirement of the government procurement process.” [7]

The reasons given include that a size- and role-agnostic tool “struggled to meet the diverse needs of different users”, that “SMEs may lack the resources and in-house expertise needed to navigate them effectively”, and that “insights regarding the potential impact on competition” would inform future policy. [7]

An accuracy note, because the two documents are not interchangeable. The February 2026 government response does not mention ISO/IEC 42001. The 42001 lineage comes from the November 2024 Assuring a Responsible Future for AI report. We cite each claim to the document that actually says it.

What UK procurement policy says about AI, and what it does not

Two Procurement Policy Notes carry AI. Between them they cover disclosure and national security. Neither mentions a certification.

PPN 017 — transparency of AI use in procurement

Published 17 February 2025, PPN 017 is the Procurement Act 2023 instrument. Its subject is the disclosure of the supplier’s AI use — whether you used AI to write your bid, and what the buyer may ask about it. It is not about certifying an AI management system, and it does not require one. [8]

It is also more permissive than most bidders assume, and says so in terms: “It is important to note that suppliers’ use of AI is not prohibited during the commercial process but steps should be taken to understand the risks associated with the use of AI tools in this context, as would be the case if a bid writer has been used by the supplier.” [8]

Two precision points. PPN 017 does not use the language of superseding PPN 02/24; its actual sentence is “For procurements commenced and contracts awarded before this date, please refer to PPN 02/24”, and PPN 02/24 remains listed under the Public Contracts Regulations 2015 section of the PPN collection. And the PDF’s own dateline reads “Originally issued: November 2023 / Updated: February 2025”, which contradicts the GOV.UK publication date — we cite the GOV.UK page date. [8]

PPN 025 — national security, and AI as a critical sector

Published 19 June 2026, PPN 025 names artificial intelligence as one of four critical national-security sectors, alongside shipbuilding, steel and energy infrastructure, with DSIT as the AI Sector Lead. It “applies only to central government departments, their executive agencies and non-departmental public bodies”. [14]

This is the honest answer to “where is UK AI procurement policy actually going”: towards strategic market shaping and the national security exemption, not towards a certification gate. GOV.UK contradicts itself on the date — the publication page says 19 June 2026, the collection listing says 3 July 2026, and the document’s own dateline says “Issued: June 2026”. We use 19 June 2026.

The notice that does name it, read closely

One notice is a small number, and it is also a document you can read. Three details in it tell you more about the state of this market than any survey would.

ISO 42001 vs ISO 27001: what UK buyers actually ask for

The useful version of “do I need ISO 42001” is comparative. Put it beside the certifications that appear in the same notices and the answer stops being a matter of opinion.

Pick one and the instrument reads its live numbers straight out of our corpus. The bar is drawn against the most-demanded certification in the set rather than against the corpus, because against 745,098 notices every one of these rounds to nothing.

On the same corpus and the same method, ISO 9001 appears in 412 notices against ISO 42001's 1 — roughly 412 times as often. That ratio, not the raw count, is the thing to carry away.

The practical reading for a supplier: ISO/IEC 27001 and Cyber Essentials are the certifications that actually gate UK public work in this space, and if you are choosing where to spend a certification budget with a tender in mind, that is where the evidence points. ISO 42001 is a differentiator you can lead with, not a gate you are failing. We break the wider set down on UK tender certifications, and per-requirement on the ISO 42001 requirement page.

AI buying is accelerating while the standard is absent

The negative finding above would be misleading on its own. The spend is arriving; it is the certificate that is not the gate.

Notices naming artificial intelligence have gone from 7.2 per 10,000 in 2019 to 12.9 per 10,000 in 2026 (a part year). That is the demand curve for the work. It is not the demand curve for the certificate.

Two caveats, both load-bearing. The series is a rate per 10,000 notices, never a raw count, because how much we ingest differs by year and raw counts across years would be invalid. And the 24 February 2025 Procurement Act go-live sits inside this series — notice conventions changed then, so the difference between the two colours is partly a change in how notices are written and not purely a change in what buyers are buying. 2026 is marked with an asterisk because it is a part year; the rate handles that correctly where a raw count would not. [15]

The EU AI Act dates, and why the old one is everywhere

Most pages arguing that ISO 42001 is about to become a procurement requirement lean on an EU deadline that moved. If you are reading a page that still says 2 August 2026, you are reading a page written before the Omnibus.

The AI Omnibus entered into force on 27 July 2026. The European Commission’s own wording: “On 27 July 2026, the AI Omnibus enters into force across the EU.” [10] The instrument is Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026. [11] Cite the regulation number and the OJ date rather than an adoption month: the number is checkable and the month is what gets misremembered.

High-risk obligations now apply from 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for Annex I systems embedded in products. [10] Citing the OJ number rather than a tracker is both the correct source and a visible freshness signal, because nearly every competing page still carries the superseded date.

Two things this does not do, and they are the ones that get overstated. It does not make ISO 42001 mandatory anywhere — the Act works through conformity assessment against harmonised standards, and 42001 is a management-system standard rather than a harmonised standard under the Act. And it does not bind a UK buyer at all. It matters to a UK supplier because it may bind you, in the EU market, on those dates.

ISO 42001 tender requirements: where they would actually appear

If a buyer did want this, there are only a few places in a UK procurement where it could legitimately land — and knowing which one changes what you have to do about it.

Under the Procurement Act 2023 a certification can appear as a condition of participation, which is a gate: you either satisfy it or you are excluded, and the condition must be proportionate to the contract. [9] It can appear as an award criterion, which is scored rather than pass/fail — here the certificate earns you points and its absence costs you some. Or it can appear as a contractual term, an obligation to hold or obtain something during delivery rather than at bid time, which is the most negotiable of the three and the one most often missed.

The one notice we hold is the fourth case, and it is the commonest: a mention in a capability list. It is neither a gate nor a scored criterion — the buyer is describing the frameworks the service should operate within. That is worth recognising, because responding to a capability list as though it were a gate is how suppliers talk themselves out of bidding.

How we counted, and the match we threw away

A method section that shows you its own false positive is worth more than three paragraphs asserting rigour. Here is ours.

The population is every UK notice we hold from Find a Tender and Contracts Finder — 753,990 at the moment this page was served, the most recent published 19 August 2026. Of those, our requirements classifier has scanned 745,098, at classifier version 5, on 1 August 2026. It matches against the notice’s title and description, stores the sentence each match came from, and records a separate flag for obligation language.

A crude string search returns more, and the extra one is not a standard. Searching the whole corpus for the raw digits “42001” returns 2 matches, where the classifier keeps 1. The one it rejected is below.

The same conservatism holds across the whole set rather than being tuned for this page. Raw string against extracted, on the two nearest comparators: ISO 9001 returns 508 raw and the extractor keeps 412; ISO 27001 returns 238 raw and the extractor keeps 224. The extractor understates by design, because a false positive in a published count is worse than a missed match.