AI assurance: who audits and certifies AI

A-LIGN audits AI management systems for ISO/IEC 42001 certification and offers a separate readiness assessment. Its certification service assesses whether the organisation’s documented AI management system conforms to the standard. Public examples include AvISO and Webdox.

A-LIGN Compliance and Security, Inc. holds ANAB accreditation MS-4760 for ISO/IEC 42001. Its headquarters are in Tampa. Hg lists A-LIGN in its portfolio, following a 2025 agreement to acquire a majority stake from Warburg Pincus.

The issuing body is Baker Tilly Certifications LLC in Seattle, accredited by ANAB under MS-2966 for ISO/IEC 42001:2023. ANAB records its January 2026 name change from Moss Adams Certifications LLC.

Superhuman’s public certificate, reissued in May 2026, identifies Baker Tilly Certifications as issuer and Superhuman as an AI provider. It references ISO/IEC 17021-1 and ISO/IEC 42006, defines the products and teams within the AIMS scope, and provides for surveillance audits.

BARR Certifications LLC, headquartered in Fairway, Kansas, certifies AI management systems to ISO/IEC 42001:2023 under ANAB accreditation MS-2444. A public example is Cadwalader, Wickersham & Taft’s 2026 certificate, which names BARR as the certification body and requires annual surveillance audits. The scope covers its integrated management system as an AI user, supporting legal information processes.

BSI offers independent assessment and certification of AI management systems to ISO/IEC 42001, alongside training and gap assessments. Its certification work examines the management system an organisation uses to govern AI development and use.

BSI Assurance UK Ltd holds UKAS accreditation 0003, whose scope includes ISO/IEC 42001:2023. BSI Group The Netherlands B.V. holds RvA accreditation C 122 for ISO/IEC 42001. BSI Assurance UK Limited also appears in ANAB’s directory under MS-5664 with the standard in scope. The group lists its headquarters in London.

BSI separately offers AI Algorithm Auditing & Dataset Testing. It evaluated DeepEyeVision’s eye-diagnosis tool to check whether the company accurately reported its AI performance metrics. This service examines reported model performance and the datasets behind it.

Bureau Veritas audits organisations for ISO/IEC 42001 certification. Its Indian subsidiary, Bureau Veritas (India) Pvt. Ltd., holds NABCB accreditation AI 004 for ISO/IEC 42001:2023, valid from June 2026 to June 2029.

Bureau Veritas Polska publicly names allclouds.pl as an ISO 42001 certification customer. The group’s registered headquarters are in Courbevoie.

Coalfire Certification, Inc., based in Alpharetta, Georgia, holds ANAB accreditation MS-4539 for ISO/IEC 42001:2023. It audits the AI management system. Coalfire’s AIMS+ service adds model testing for fairness, explainability, robustness and security as a separate part of the offering.

A separate technical-assessment example is Workday’s published account of Coalfire evaluating its AI processes against NIST AI RMF. Workday identifies Schellman as its ISO 42001 certifier.

DEKRA offers ISO/IEC 42001 certification, with an initial assessment of documentation followed by an assessment of how the AI management system works in practice. Certificates have a three-year cycle with surveillance audits.

DEKRA Certification, Inc. holds ANAB accreditation MS-7497 with ISO/IEC 42001 in scope. The group is based in Stuttgart and owned by DEKRA e.V..

DNV offers ISO/IEC 42001 certification of AI management systems. Its Dutch certification entity, DNV Business Assurance B.V., has RvA accreditation C 024, with ISO 42001 in scope. DNV names Cognizant as a customer that received accredited certification.

The group’s headquarters are in Høvik, outside Oslo. DNV is ultimately owned by Stiftelsen Det Norske Veritas, through Det Norske Veritas Holding AS.

DQS Inc., headquartered in Schaumburg, Illinois, holds ANAB accreditation MS-7328 for ISO/IEC 42001:2023. DQS’s certification process examines documentation and the operation of AI governance, data management and human oversight, followed by an audit report and certification decision.

In Japan, DQS Japan announced certification of Knowledge Creation Technology in January 2026. That is a customer example from a separate group entity; the US accreditation belongs to DQS Inc.

Intertek SAI Global certifies AI management systems through SAI Global Certification Services Pty Ltd, headquartered in Sydney. Its JASANZ scope includes ISO/IEC 42001:2023 under the AI Management System Scheme, with ISO/IEC 17021-1 and ISO/IEC 42006 among the accreditation requirements.

Outseer announced ISO/IEC 42001 certification from Intertek in July 2026. The customer announcement concerns governance of AI used in fraud and scam prevention. It does not identify the issuing legal entity or establish that this customer used the Australian accreditation route.

LRQA offers ISO/IEC 42001 certification for AI management systems. LRQA Limited holds UKAS accreditation 0001 for this work. The company lists its headquarters in Birmingham.

A recent public customer is ISPnext, which says LRQA certified its AI management system in October 2026. The scope covers the design, development, maintenance and provision of AI features in its Source-to-Pay platform. LRQA became an independent business in 2021 with backing from Goldman Sachs Asset Management.

MHM Advisory certifies AI management systems to ISO/IEC 42001 from Canada. The Standards Council of Canada scope lists the standard under its accreditation, and the firm announced the AI accreditation in 2025. The certificate covers how an organisation manages AI, not the performance of a model.

Mastermind Assurance certifies AI management systems to ISO/IEC 42001:2023 under IAS accreditation MSCB-356. The current accreditation scope also names ISO/IEC 42006:2025, the requirements for bodies that audit and certify these management systems. IAS lists Mastermind in Alpharetta, operating virtually.

A public example is Grammarly’s certificate, issued in March 2025. Its scope covers the management system behind Grammarly’s desktop, browser, mobile and other listed offerings, and identifies the AI developer role. The certificate limits the certification decision to that management system.

NQA certifies AI management systems through NQA Certification Ltd, whose head office is in Houghton Regis, Dunstable. Its UKAS accreditation 0015 includes ISO/IEC 42001:2023 for AI developers, producers, providers and users, under ISO/IEC 17021-1 and ISO/IEC 42006.

Spark, a content adaptation and localisation agency, obtained certification through NQA’s accreditation pilot. NQA’s certification cycle has two initial audit stages, annual surveillance and recertification after three years.

Schellman Compliance, LLC holds ANAB accreditation MS-3780 for ISO/IEC 42001. The Tampa-based issuer’s September 2025 certificate for UiPath covers the AI management system supporting named services, including Document Understanding, Communication Mining, Autopilot and Agents.

The certificate identifies UiPath’s AI producer and provider roles and requires annual surveillance. Its scope covers specified functions and locations in the United States, Romania and the UK. Certification concerns that management system and does not authorise product or service labelling.

Sensiba provides independent audits for ISO/IEC 42001:2023, covering AI management systems and their lifecycle, ethics and transparency controls. Sensiba LLP holds ANAB accreditation MS-1128 for ISO/IEC 42001, alongside ISO/IEC 27001 and ISO/IEC 27701. The accounting and consulting firm lists its headquarters in San Jose.

SGS provides third-party audits and certification to ISO/IEC 42001:2023. The assessment covers an organisation’s AI management system, including its approach to risk, data quality and the AI lifecycle. SGS North America Inc. holds ANAB accreditation MS-3454 for the standard.

A public example is Changi Airport Group, whose certificate covered an AI management system for five commercial and passenger applications, including product recommendations and generative AI search. That certificate was issued under Singapore Accreditation Council accreditation. SGS inaugurated its global headquarters in Baar in January 2026.

TÜV NORD offers ISO/IEC 42001:2023 certification through TUV UK Limited in Croydon. UKAS accreditation 0065 covers the AI developer, producer, provider and user roles, under ISO/IEC 17021-1 and ISO/IEC 42006.

The group also reports Dutch RvA accreditation and names Mentech Innovation as a certification customer. The Mentech announcement concerns AI management in healthcare. The issuing entity and accreditation route must match the certificate offered to the buyer.

TÜV Rheinland certifies AI management systems to ISO/IEC 42001:2023 through TUV Rheinland of North America, Inc., headquartered in Boxborough, Massachusetts. Its ANAB scope MS-8450 includes ISO/IEC 42001, with initial accreditation in September 2025. The certificate concerns the organisation’s management system within its defined scope.

A separate group entity, TÜV Rheinland Japan, certified NTT DATA Group and NTT DATA Japan in December 2025. That scope covers development and provision of LITRON Generative Assistant; the Japanese example has a different issuer from the US accreditation.

TÜV SÜD certifies AI management systems against ISO/IEC 42001:2023. Its Singapore entity, TÜV SÜD PSB Pte Ltd, has Singapore Accreditation Council accreditation for this work.

TÜV SÜD South Asia Private Limited separately holds NABCB accreditation AI 002 for ISO/IEC 42001:2023, valid from August 2025 to August 2028. The accreditation applies to that legal entity. The group’s headquarters are in Munich.

Advai Ltd, based in London, tests AI accuracy, robustness and security. Its published AI Verify pilot with CheckMate evaluates a WhatsApp scam and fact-checking service that uses an LLM agent.

The assessment uses human red teaming, benchmarks and synthetic inputs to test misclassification, harmful content, subtle adversarial manipulation and denial of service. Advai selected risks and thresholds for the application’s business use. The case reports technical evaluation work under the pilot methodology, with no claim of accredited certification.

Armilla AI Inc., headquartered in Toronto, offers independent model testing through Armilla Verified. Its proprietary assessment produces an internal report and, when its benchmarks are met, a public badge. Tests cover performance, fairness, robustness and security.

A May 2025 TELUS case describes bilingual evaluation of a generative AI customer-service tool through automated testing, manual review and red teaming. Criteria included TELUS’s commitments, NIST AI RMF, ISO/IEC 42001 and the Responsible AI Institute framework. This assessment is separate from accredited management-system certification.

Asenion offers independent AI testing alongside its self-service testing software, covering bias, accuracy, privacy, security, safety and agent behaviour. It maps findings to frameworks including NIST AI RMF and ISO/IEC 42001; its ISO 42001 work includes audit readiness.

For Mind Interview, Asenion reports synthetic-profile bias testing using its chosen four-fifths benchmark. Sex and race varied while answers stayed constant. NYC’s LL144 rules require calculations and disclosure, with no prescribed pass threshold; this synthetic test alone does not establish a complete statutory audit. Asenion also names impress.ai as a testing partner and identifies Kitchener-Waterloo and Stockholm as its locations.

BABL AI offers independent bias audits for NYC Local Law 144. Its auditors review evidence against audit criteria, including selection rates and impact ratios for protected categories, and may seek further documentation or interview stakeholders.

Eightfold AI publishes BABL’s March 2026 audit summary for the Eightfold Matching Model. BABL’s registered address is in Iowa City.

BLDS, a US economics and statistics consultancy, audits automated hiring tools under New York City's Local Law 144. Morgan Stanley's July 2026 bias audit of the Eightfold model it uses to score applicants was carried out by BLDS, retained through outside counsel.

DCI Consulting Group, a Washington, D.C. employment analytics firm, runs independent bias audits of hiring tools under New York City's Local Law 144. The audit reports selection rates and impact ratios by sex and race. Its summary for HireVue's assessments, published by Pfizer, names DCI as the auditor.

Eticas.ai evaluates AI systems in their deployment environment, including the data, model, business rules, people and processes around them. Its tests cover bias, explainability and data quality for predictive systems; hallucinations, retrieval quality and data leakage for LLM applications; and oversight and action traceability for agents. It selects metrics and benchmarks for the deployment and regulatory context, including NYC Local Law 144 and the EU AI Act.

A public example is its post-deployment audit of Career Scoops, an AI career advisory platform for students aged 13 and above. The company lists its headquarters in New York.

Holistic AI conducts independent bias audits of hiring tools for NYC Local Law 144. Its Hired case study describes an initial audit, annual audits and additional reviews after major system changes.

The company also offers fairness testing and red teaming of generative AI and agents, including tests for prompt injection, data leakage and unsafe tool use. It lists its headquarters in San Francisco.

Laboratoire national de métrologie et d’essais, headquartered in Paris, evaluates AI algorithms and operates a voluntary certification scheme for AI design, development, evaluation and maintenance processes. Its own published certification standard defines the requirements and audit cycle.

Axionable’s published audit account describes LNE certification of its AI development methodology. LNE’s scheme concerns lifecycle processes and how developers establish and evaluate requirements for their applications. The cited scheme is distinct from ISO/IEC 42001 certification and EU AI Act notification.

Mindgard, a London company, sells AI penetration tests run by its own researchers. The engagement ends in a written report and a retest letter, measured against the OWASP Top 10 for LLM applications and MITRE ATLAS. It also offers red-teaming engagements for chat assistants and agents.

ORCAA offers bias audits for NYC Local Law 144, using data from a particular hiring tool and its use to analyse disparate impact. It works with both tool vendors and employers. Its public work also includes an AI governance review for Uber.

For health IT, ORCAA and the Duke Institute for Health Innovation offer HTI-1 reporting support, including research on predictive decision support tools’ validity and fairness and independent review of compliance reports.

Resaro provides independent technical evaluation of AI systems. The business identifies Resaro International Pte Ltd and Singapore as a headquarters location. Its published AI Verify pilot case with Tookitaki covers FinMate, a generative AI assistant for anti-money-laundering investigations.

Testing assessed factual accuracy and faithfulness against ground truth, plus responses to queries that violated policy. The published case describes precision and recall measures, synthetic test data and misuse tests. This is evaluation against the pilot’s application-specific criteria; the document establishes neither laboratory accreditation nor an AI Act conformity certificate.

TÜV AUSTRIA CERT GMBH, based in Brunn am Gebirge, offers Trusted AI certification for supervised-learning applications. Its scheme assesses robustness, security and suitability for a defined use, with documentation review, interviews, technical inspection, annual monitoring and recertification after three years.

SCANTEC’s SmartScan waste-composition analysis technology received the Trusted AI Application mark. The scheme uses TÜV AUSTRIA’s own audit catalogue. Separately, the group announced ISO 42001 accreditation in October 2026; that management-system service has a different assessment subject.

UL Solutions provides AI product certification under UL 3115, the Outline of Investigation for Safety of AI-Based Products. The scheme operator is UL LLC in Northbrook, Illinois; it evaluates digital AI products and issues three-year certificates with ongoing assessments.

Its Omniconn Platform 4.0 case describes documentation review, process evaluation and technical examination of AI used in smart-building operations. The assessment covers technical, ethical and governance safety requirements. The resulting AI safety certification concerns the evaluated product and its intended use.

Warden AI Ltd is based in London and delivers external bias audits of hiring AI. Its published Beamery AI Talent Match report applies NYC Local Law 144 bias-audit methods to sex, race/ethnicity and intersectional categories.

The 9 October 2026 Beamery report uses Warden’s test dataset of real candidate profiles because historical data was unavailable. It reports scoring rates and impact ratios, with team review of platform-generated results. The report limits the findings to controlled test conditions and excludes a determination of full LL144 compliance. The public dashboard also reports monthly testing across additional bias categories. For an employer using the tool, reliance on the audit depends on its system, data and relevant hiring use.

BDO Germany audits AI systems under IDW PS 861 and examines the IT processes, governance and internal controls around their use. Engagements can begin with a gap analysis or readiness assessment, or proceed to a formal audit.

BDO Australia also lists AI readiness and assurance and assurance over machine learning and advanced analytics. These are member-firm offerings with locally defined scopes. BDO’s global network headquarters are in Brussels.

In the US, BDO’s ISO certification audit service includes ISO/IEC 42001 for AI management systems, with readiness assessments and gap analysis also available.

Deloitte’s AI Assurance service offers independent engagements against recognised regulations, standards or other suitable criteria. Its technical reviews examine model design and data pipelines and use adversarial stress tests. Readiness work covers ISO/IEC 42001 and the EU AI Act.

The UK service also reviews accuracy, explainability, bias, monitoring and the controls around AI platforms. Deloitte Touche Tohmatsu Limited, the network’s coordinating entity, is registered in London; member firms provide client services.

Dornbach offers AI-system examinations under IDW PS 861, covering IT security, traceability, ethical requirements and performance. Its published service names Jochen Ball and Roman Brinskelle as contacts; the legal notice identifies their firm as DORNBACH GmbH Wirtschaftsprüfungsgesellschaft Steuerberatungsgesellschaft, registered in Bad Homburg under HRB 6610.

The offering separates AI-system examinations from governance consulting. The engagement must specify the system, criteria, reporting period and report issuer.

EY’s German member-firm AI assurance offering includes examinations under IDW PS 861 and examination reports. The service separately lists readiness assessments, governance reviews and compliance support. The engagement defines the system examined, criteria and issuing member firm.

A separate legal entity, Ernst & Young CertifyPoint B.V. in Amsterdam, issues ISO/IEC 42001 management-system certificates. Its October 2025 certificate for iret covers internal AI use, with customer-facing services excluded. The document references ISO/IEC 17021-1 and ISO/IEC 42006; it does not establish CertifyPoint’s accreditation for ISO 42001. This certification belongs in the certification group, separate from EY member-firm assurance reports.

KPMG’s AI Trust service includes AI assurance: examining evidence and reporting on management processes, controls and claims about responsible AI use. The US firm also offers model risk assessments, quantitative testing and model validation, including tests of accuracy, assumptions and regulatory compliance.

Its AI assurance offering aligns with the NIST AI Risk Management Framework and ISO/IEC 42001. KPMG International Limited, the network’s coordinating entity, is registered in London.

PwC’s US AI assurance service assesses AI governance, risk management, security, privacy and controls over model development and deployment. Its AI Risk Report provides independent assurance under AICPA standards, with the engagement aligned to defined criteria and frameworks.

The service addresses risks such as bias, model drift and reliance on third parties. PwC also considers how the engagement relates to existing SOC reporting. The network’s coordinating entity, PricewaterhouseCoopers International Limited, is registered in London; client engagements are delivered by member firms.