Ethicality Certification vs ISO 42001 vs SOC 2: Which Do You Need?
October 21, 2026
A client asks how your firm handles AI. Someone mentions ISO 42001. Someone else says you need SOC 2. These answer different questions, and most small firms don't need all three. Here's what each one shows, who it's built for and how to choose.
The short answer
- SOC 2 shows how you protect data and systems. It's a security attestation report, not a certification.
- ISO/IEC 42001 certifies an AI management system: the policies, roles and processes an organization uses to govern AI.
- An Ethicality certification, shows how your people use AI day to day. That means transparency with clients, keeping confidential data out of public tools, and human review of AI-assisted work.
If you build or sell AI products, ISO 42001 may be worth the investment. If your firm uses AI tools to serve clients, an AI use certification answers the question clients are actually asking.
Side-by-side comparison
| SOC 2 | ISO/IEC 42001 | Ethicality AI use certification | |
|---|---|---|---|
| What it shows | Security and controls over data and systems | A management system for AI | Transparent, human-led use of AI at work |
| Result | Attestation report | Certificate | Badge, numbered certificate, public registry entry |
| Built mainly for | Service providers holding client data | Organizations that produce, provide or use AI systems | Businesses and professional firms that use AI |
| Typical cost for a small organization | Varies by provider; not covered here | $15,000–$35,000 under 50 employees (CertPro estimate) | $300–$700 per year for up to 50 people (pricing) |
| Typical time | Varies | 4–6 months with managed help, 8–12 months self-directed (Bastion) | About 10 minutes to apply, decision within 5 business days |
What SOC 2 tells clients
SOC 2 is a report on a service organization's controls for security and related areas. BARR Advisory notes that it does not result in a formal certification. It is widely requested in North America, especially by buyers of software and data services.
What SOC 2 doesn't tell a client is whether your team discloses AI use, or whether a person reviews AI-drafted work before it reaches them.
What ISO/IEC 42001 tells clients
ISO/IEC 42001 is an international standard for an AI management system. Its scope covers organizations that produce, provide or use products or services that use AI systems (BARR Advisory). Certification typically involves building the management system, documenting it and completing a third-party certification process.
As Ethicality's FAQ puts it, "ISO 42001 asks whether you have an AI management system." For a 200-person AI product company, that's often the right question. For a 12-person accounting practice that uses an AI assistant for drafting, it's usually more than clients are asking for.
What an AI use certification tells clients
The Ethicality certification is assessed against the Ethicality AI Use Standard (EAUS 1.0), 15 plain requirements covering three things:
- Confidentiality and clear rules: written AI rules, approved tools, and no sensitive data in public AI tools
- Transparency: openness with clients about meaningful AI use, and accurate public statements
- Human oversight: a person reviews material AI-assisted work and stays responsible for it
It doesn't certify AI systems, an AI management system or legal compliance. Ethicality says so directly on what certification means. Its purpose is to make your AI practices visible and verifiable through a public registry.
Which should your firm get first?
| If this describes you | Start with |
|---|---|
| Clients send security questionnaires about their data | SOC 2 |
| You build or sell AI products, or clients require an AI management system | ISO/IEC 42001 |
| You use AI tools to serve clients and want to show you do it responsibly | An AI use certification |
| Two or more of the above | They're complementary; start with the one clients ask for most |
These aren't either-or. An AI use certification doesn't replace SOC 2 or ISO 42001 where a contract requires them. It answers a different and more common question: how does this firm use AI on my work?
Frequently asked questions
Is ISO 42001 mandatory?
No. ISO/IEC 42001 is a voluntary standard. Requirements can still come from client contracts.
Does SOC 2 cover AI?
SOC 2 can include systems that use AI, but its focus is security and related controls, not how staff disclose or review AI-assisted work.
Does an AI use certification prove legal compliance?
No. The Ethicality certification "does not certify compliance with any law." It reflects an independent assessment of disclosed AI-use practices.
See where your firm stands
Take the free 2-minute readiness check, or apply for Ethicality certification and get a decision within 5 business days.