ISO 42001 Case Studies: What Real Certifications Show

Search for ISO 42001 case studies and you mostly find two kinds of page: a consultancy showing off a single client, or a bare list of certified logos. Neither answers the question an implementer is actually asking, which is what certification took in practice and what it changed. That is the question this page is built to answer.

The honest starting point is that ISO/IEC 42001:2023, the AI management system standard, is young. It was published at the end of 2023, so the body of certified organizations is still growing rather than settled. What has changed since the first certificates is that adoption is now large enough to read patterns from, and the public cases tell a consistent story about who certifies first and why.

This guide from the AI Governance Certification Institute (AIGCI) reads that evidence the way a case study should be read: for the pattern, not the promise. It covers who is getting certified and how fast, what the public cases share, how certification plays out by sector, and how to turn any case study into a plan for your own. It is the real-world counterpart to what training includes.

Who Is Getting Certified, and How Fast

Start with the question behind most searches: is anyone really doing this yet? The answer is yes, and the pace is the part most pages miss.

A third-party directory that tracks publicly announced ISO/IEC 42001 certifications counted 217 of them across 29 countries by early October 2026. The same source shows the trend clearly: announced certifications rose from 18 in 2024 to 88 in 2025, with more than 100 already in 2026. Those figures come from public announcements rather than an accreditation registry, so the real number is higher, but the direction is unmistakable. Early curiosity has turned into steady adoption.

The first mover set the tone. AI Clearing, a construction-technology company based in Austin, Texas, was certified by an accredited body at the standard's final-draft stage in late 2023 and is widely described as the first technology company to earn the certificate. Since then the visible adopters have skewed toward companies whose product is AI or whose platform now runs on it, including software and customer-experience firms such as Anaplan, Typeform, ibex, Talkdesk, and Perforce, alongside large providers certifying specific services, as Microsoft has done for its Copilot offerings.

Read the small base as timing, not doubt. The organizations with the most to prove, those whose customers are already asking how their AI is governed, are moving first, exactly as happened in the early years of other management system standards.

Four ISO 42001 Case Studies From the Public Record

Detailed internal accounts are still scarce, but several organizations have certified publicly and described what they did. The four below are drawn from their own announcements, which means they are candid about the headline and quiet about the struggle, so read them for the decisions rather than the triumph. Together they span construction technology, customer experience, developer tooling, and enterprise planning, and the table sets them side by side before each gets a closer look.

AI Clearing: The First Technology Company to Certify

AI Clearing, a construction-technology company based in Austin, Texas, uses AI to turn survey and drone data into construction progress reports through a software platform. According to the certifying body's announcement, it earned its AI management system certificate in late 2023, at the standard's final-draft stage, and is described as the first technology company to do so. The company framed the certificate as letting it deploy AI more safely and efficiently for the contractors and asset owners that depend on its reports.

The transferable lesson is about timing. AI Clearing certified before ISO/IEC 42001:2023 was even formally published, which tells a later adopter that the standard was implementable from the start and that moving early is itself a signal a company can point to. The risk it accepted, a certificate issued against a draft, is the trade every pioneer makes.

Talkdesk: Certifying to Move AI From Pilot to Production

Talkdesk builds AI into customer-service software, the automated agents and assistance that handle contact-center interactions. In its own announcement in early 2026, the company said it embedded ISO 42001 practices into the development, operation, and governance of its customer experience automation platform, and tied the work to a stated reason: adoption of AI in customer service often stalls over worries about reliability and compliance. It presented the certificate as third-party proof that lets customers move AI from experimentation into full production, part of an approach it calls trust by design.

The lesson here is about the driver. Where AI touches customers directly, trust is the thing that unblocks a sale, and a recognized certificate answers the buyer's governance question faster than any questionnaire. The scope decision is instructive too, because Talkdesk certified the platform its customers actually use rather than an abstract corporate boundary.

Perforce and Puppet: Certifying the AI Features, Not the Whole Company

Perforce, a developer-tools company, and its Puppet IT-automation line took a different path. In early 2026 it announced that several AI products and features within its portfolio, rather than the entire company, had been certified, and pointed to a maintained list of which products are in scope. Puppet described itself as among the first IT-automation products to certify its AI features.

The lesson is discipline about boundaries. By certifying named AI capabilities instead of everything at once, Perforce kept the AI management system small enough to defend and the evidence focused on the features that genuinely use AI. It also left room to add more products to the certificate over time, which is a realistic way to scale governance without stalling on day one.

Anaplan: Folding AI Governance Into an Existing Program

Anaplan, which makes enterprise planning software, announced its certification in 2026 for the responsible AI governance behind its platform. What stands out from its announcement is the context: the company already held a stack of other certifications, including ISO/IEC 27001 and independent service-organization reports, and presented ISO 42001 as an addition to that program rather than a standalone project.

The lesson is reuse. An organization that already runs a management system has the scope statements, document control, internal audit, and management review machinery in place, and ISO 42001 extends that spine to AI rather than rebuilding it. For a reader who already holds another ISO certification, this is the most encouraging pattern in the set.

How Certification Is Spreading Across Sectors

The four cases above are all software companies, which is where adoption started. Through 2026 the certificate moved into regulated, higher-stakes sectors, and that is where the next wave of case studies is coming from.

Financial services moved first and fastest. Axis Bank in India was described as the first financial-services institution to earn the certificate from its accredited body, following an audit of its AI governance, risk management, and delivery practices, and consumer banks in Indonesia and Bahrain certified soon after as national firsts. The driver in banking is blunt: enterprise buyers and regulators increasingly treat documented AI governance as a baseline, and a certificate answers that expectation faster than a stack of questionnaires.

Healthcare is where the stakes make the standard sharpest, because AI there can touch patient safety directly. A health-technology company, Sorsix, certified the AI management system behind its platform specifically so that hospital partners, government clients, and regulators could rely on independent assurance rather than its own word. With much medical AI treated as high-risk under the EU AI Act, that kind of third-party proof is shifting from a differentiator to a condition of doing business.

Government appears in these stories more as a demanding buyer than as a certificate holder so far. Public health authorities and agencies are among the clients asking vendors for assurance, which pushes certification down the supply chain even where the public body itself has not certified. If you work in or sell to the public sector, watch procurement, because the requirement tends to arrive in a contract before it arrives in a law.

Scope Is the Decision That Shapes Everything

If one lesson runs through every public certification, it is that scope is chosen, not inherited, and that choice decides the size of the whole project.

The cases cluster around three scope decisions. Some certify a single product or feature set, which keeps the AI management system small, the evidence focused, and the timeline short, at the cost of a certificate that speaks only to that product. Others certify a whole platform, accepting a larger and more complex system in exchange for one certificate that covers many AI features at once. A third group, usually large providers, certifies named services rather than the company, so the certificate maps precisely to what customers actually buy. None of these is more correct than the others. Each is a trade between how much the certificate covers and how much work it takes to earn.

The practical reading is that your own scope is the first and most consequential decision you will make. Draw it too wide and the project stalls under its own weight; draw it too narrow and the certificate reassures no one. The organizations whose case studies read cleanly are almost always the ones that made this call deliberately and early, which is why it belongs at the very front of your planning rather than halfway through it.

The Patterns Underneath the Logos

Strip away the names and the public cases repeat the same handful of moves. These transferable patterns are worth more than any single logo:

•     Scope before everything. The cases that read cleanly defined what they were certifying, a product or a service, before touching a control.

•     AI-first companies lead. When AI is the product, governance is a sales asset, so these firms certify first and talk about it loudest.

•     The driver is trust, not the wall plaque. Almost every announcement frames certification as proof for customers, buyers, and regulators rather than an internal milestone.

•     Responsible-AI language is the frame. The public cases describe the certificate as evidence of ethics, transparency, and oversight, not just compliance.

•     Evidence is the hard part. The standard rewards records that prove controls run, which is where the real effort goes once scope is set.

These patterns double as a map of what a project involves, which is laid out step by step in the implementation guide, and they explain why the role is as much judgment as paperwork, the mix of capabilities covered in the skills you build as a lead implementer.

The Challenges the Early Case Studies Reveal

Announcements celebrate the certificate. The quieter and more useful detail is what the early adopters had to fight through, and a few of the honest accounts spell it out.

A readiness account from a fintech software startup is the most candid of them. Its hardest problems were not the policy documents but the novelty: the standard was so new that there was little precedent to copy, and even finding an accredited certification body took effort in the early market. The team reused the management-system controls it already ran for security, then had to adapt its secure development lifecycle to meet AI-specific requirements, which is where the real work sat.

Those struggles generalize into a short list worth expecting on your own project:

•     Thin precedent. Early adopters had few examples to follow, which is exactly the gap case studies like these now fill.

•     Choosing a certifier. With accreditation still maturing, selecting an accredited body is a real decision rather than a formality.

•     Reuse, then adapt. Existing security and quality controls carry over, but AI-specific requirements such as impact assessment and model monitoring are new work.

•     Evidence over intent. The effort concentrates in producing records that prove the AI controls actually run, not in writing that they should.

What a Case Study Can and Cannot Tell You

Case studies are useful, but reading them well means knowing what they prove and what they do not.

By its nature a case study trades breadth for depth. Its strength is a rich, close look at how one organization worked, and that is also its limit: a single case is not a representative sample, so it cannot promise your project will go the same way. The honest value of a case study is insight into the how, not a forecast of the outcome. That caution is not just theoretical. A systematic review of the literature on ISO/IEC 27001, the closest comparable management system standard, found that very few studies had examined the outcomes of certification empirically, so even the mature neighbor of this standard has thin evidence that the certificate itself produces the results companies hope for.

So read a published case study for its sequence of decisions and the kind of evidence it produced, and discount its happy ending. The cost overruns, the controls quietly narrowed, and the months lost to an AI inventory rarely make it into the announcement.

How to Read an ISO 42001 Case Study

Turn a case study from a story into a plan by interrogating it the same way every time. Four questions pull out everything that transfers:

•     What was in scope? Which AI systems or services did they certify, and, just as telling, which did they leave out.

•     Where did the effort go? The parts they dwell on, usually risk and evidence, are where your effort will go too.

•     What evidence did they produce? Named records, impact assessments, and monitoring results tell you what an auditor will expect from you.

•     What would they do differently? The one honest regret in a case study is often worth the rest of it combined.

Run those questions against any example and you convert someone else's project into a checklist for your own. A framework like the NIST AI Risk Management Framework gives you a shared vocabulary for the risk and impact decisions the cases keep circling back to, and it matters more as the EU AI Act pushes organizations to show documented governance rather than assert it. The case studies are early proof of what that documented governance looks like in practice.

The Honest Limits of Being Early

Reading early case studies also means reading the moment they were created in, because the certification market around the standard is still maturing.

The earliest certificates, including the first mover's, were issued at the standard's final-draft stage before formal publication, which is normal for a new standard but worth knowing when a case claims to be first. More importantly, the rules for the bodies that certify to ISO/IEC 42001:2023 were themselves only published in 2025, and accreditation for those bodies has been settling through 2026. A certificate from an accredited body carries more weight than one issued before that framework matured, so part of reading a case study is noting when and by whom the certificate was granted, not just that it exists.

Frequently Asked Questions

Who Was the First Company Certified to ISO 42001?

AI Clearing, a construction-technology company in Austin, Texas, is widely described as the first technology company to earn ISO/IEC 42001 certification, achieved at the standard's final-draft stage in late 2023. Because many certifications are never publicized and the first claim comes largely from the company and its providers, treat the precise ranking with some caution, but the early wave was clearly led by AI-first firms.

How Many Companies Are Certified to ISO 42001?

A directory tracking public announcements counted 217 certifications across 29 countries by early October 2026, up from 18 in 2024 and 88 in 2025. That reflects announcements rather than an accreditation registry, so the true total is higher. The useful takeaway is the growth rate: adoption has moved from a handful of pioneers to steady, broad uptake in under three years.

What Industries Are Adopting ISO 42001 First?

Software and platform companies, customer-experience and contact-center firms, developer-tool providers, and large cloud providers lead so far. The common thread is exposure: these organizations sell AI or run it at scale, so the commercial case for proving governance arrives earlier for them than for sectors that use AI lightly.

How Long Does an ISO 42001 Project Take in Practice?

Public announcements rarely disclose timelines, which is one reason to be wary of case-study promises. In practice the duration depends on scope and starting maturity far more than on any published example: a tightly scoped product or service with reasonable existing governance moves faster, while certifying many systems across many teams takes considerably longer, mostly because building the AI inventory and real monitoring outlasts the writing of documents.

Where Can I Find ISO 42001 Case Studies and Study Material?

Early case studies appear mainly as announcements from the certified companies and the bodies that issued their certificates, so read them knowing they are partly promotional. For material that teaches the standard rather than selling a service, structured training that walks the clauses with worked examples is more reliable, because it shows the implementation pattern the announcements only summarize.

Can a Small Company Realistically Get Certified?

Yes, and small scope is often an advantage. A company with one or two AI systems can define a tight scope, run a genuine risk and impact assessment, and produce clean evidence faster than a large organization wrestling with dozens of systems. The public cases confirm this, since several early adopters certified a single product or service rather than an entire company.

Turn These Patterns Into Your Own Project

The real value of case studies is not the names involved but the repeatable moves underneath them: scope tightly, lead with trust, and invest in evidence. Learning those moves deliberately is what structured training does, and you can see every route through the ISO 42001 courses, with the implementer path taught clause by clause in the Lead Implementer certification so your first case study is your own.