Where the demand is coming from first
- AI product and model companies. If AI is the product, "how do you govern it" is now a sales question, and a certificate is the answer that does not require your customer to audit you personally.
- SaaS with embedded AI features. The moment AI features touch customer data or customer-facing decisions, vendor security reviews grow AI sections. Companies already holding ISO 27001 face the questions first, from the same reviewers.
- Suppliers to regulated industries. Banks, insurers, and health systems are accountable for the AI in their supply chains; they push that accountability down as certification requirements, exactly as they did with information security.
- Enterprises with high-stakes internal AI. Hiring, credit, pricing, safety, and medical applications concentrate legal and reputational exposure; boards increasingly want independent assurance, not self-report.
- Public sector suppliers. Government AI procurement frameworks are writing governance requirements now, and certifiable standards are the natural criterion.
The EU AI Act accelerant
Organizations in scope of the AI Act need management structures for classification, documentation, oversight, and monitoring as legal obligations phase in through 2026 and 2027. ISO 42001 is the most widely adopted scaffold for that program, and certification signals to EU customers and authorities that the scaffold is independently verified. Vendors selling into Europe should assume the question arrives regardless of where they are headquartered.
Who can reasonably wait
Organizations using AI only in low-stakes internal tooling (drafting, coding assistance, search) with no AI in their products and no regulated customers can defer certification, though a basic AI inventory and use policy is prudent governance and cheap insurance. The trigger to watch is identical to every certification wave: the first questionnaire, the first tender line item, the first enterprise deal where the security review includes AI. From that signal, you are 4 to 8 months from being able to answer it with a certificate.
An honest market note
Because the standard is young, certificate quality varies: some early certificates come from rigorous accredited audits, others from bodies moving faster than their competence. Buyers are learning to ask who accredited the certification body and what the audit actually sampled. Whichever side of that transaction you are on, the substance beneath the certificate is what survives scrutiny; choose your certification body accordingly.