ISO 42001 for startups can be a 90-day file when the product is small and a founder owns the inventory. Ninety days means audit-ready for Stage 1, not a certificate. Consulting for that firm often sits between ₹4 lakh and ₹8 lakh in 2026 market ranges, not a Seven Step fee.

A founder who wants a certificate before the inventory exists will buy a binder. ISO 42001 for startups starts with the model you ship, the copilot you bought, and the sheet that scores users. AI startup compliance starts with that same list. A policy library with no system name will not survive a Stage 2 sample.

If leadership does not show up, the calendar slips. ISO 42001 for startups is a management system, the AIMS, not a logo. ISO/IEC 42001:2023 uses clauses 4 to 10. Annex A has 38 controls. You do not write an essay on all 38 in month one. You say which apply and why.

What ISO 42001 for startups covers in the first 90 days

ISO 42001 for startups uses ninety days as the Stage 1 window, a documentation review. It is not a promise of a certificate. A certification body issues the certificate after Stage 1 and Stage 2, the implementation audit. Seven Step Consulting does not issue ISO certificates. Implementation often takes 3 to 6 months, depending on size, AI maturity and how many systems are in scope. It fits ISO 42001 for startups when the inventory is small and the founder attends.

Ninety-day ISO 42001 for startups plan with a founder-owned model inventory
Window Work Done when
Days 1 to 15 Inventory of what you build, buy and paste into a browser Every production system has an owner and a purpose
Days 16 to 40 Policy, Statement of Applicability, AI risk assessment, AI impact assessment A control marked out has a reason
Days 41 to 70 Test notes, logs, incident path, vendor notes One system can be opened end to end
Days 71 to 90 Internal audit and fixes The file is audit-ready for Stage 1

On a practical file, ISO 42001 for startups means the founder can point at one row and say who stops the model. An AI system that is already in production needs an owner, a purpose, and a record of how it was tested. A spreadsheet named Final_v7, with scores and no owner, is not an inventory yet. Put it on the list.

ISO 42001 small business work is the same standard with a shorter list. An ISO 42001 small business scope names one legal entity, one product and one site. Do not copy a bank manual into an ISO 42001 small business file. The extra pages become findings when nobody can explain them.

AI startup compliance is an owner, a purpose and a test record. Buyers ask for AI startup compliance when a security questionnaire arrives with a date on page one. Do not treat AI startup compliance as a logo you purchase before the inventory exists.

What ISO 42001 for startups can skip without failing Stage 1

Skip a tool until the ISO 42001 for startups inventory exists. Skip multi-site rules if you have one office. Skip a legal opinion on every sutra. Skip a public course. Skip any seller who promises a certificate on day 90. A consultant cannot issue one.

Do not skip the internal audit. An ISO 42001 small business internal audit can be one afternoon if the inventory is a single model. Sample the live system, not the policy PDF alone. Do not skip the Statement of Applicability. A blank “not applicable” column is how lean files fail.

ISO 42001 for startups still needs an AI risk assessment and an AI impact assessment on the system you sell. ISO/IEC 23894:2023 guides the risk work. ISO/IEC 42005 guides the impact work. One model can have one risk note and one impact note. That is enough to start. A second model means a second note. ISO 42001 for startups does not need a second manual.

Shadow tools belong on the inventory. The browser copilot a teammate bought on a card is in scope if customer data goes in. A model with no owner is the finding Stage 2 will write down. Name someone, even if that someone is the founder, and give them a stop path.

The budget band, labeled as a market range

Every rupee figure here is a 2026 India market range for one legal entity. It is not a Seven Step rate card. Staff time is the cost people forget. Founder hours are real money even when they never become an invoice.

For a startup or single-product firm, consulting that carries ISO 42001 for startups often sits between ₹4 lakh and ₹8 lakh. The ISO 42001 small business budget in that same market range is this band, not the bank band of ₹15 lakh to ₹30 lakh. A mid-market firm with several systems often sees ₹8 lakh to ₹15 lakh. Do not price a one-model company as a bank.

The certification body invoices Stage 1 and Stage 2 separately, about ₹2 lakh to ₹8 lakh, driven by headcount and sites. That is a market range, not a Seven Step fee. A gap review, if you do not yet know the system list, often falls between ₹1.5 lakh and ₹4 lakh, again as a 2026 market range. After the certificate, annual surveillance is often around 40 percent of the initial audit fee, for two years, then recertification around year three. That pattern is on proposals. It is not a Seven Step fee.

Check the body’s current scope on the NABCB or IAF directory before you book. NABCB, under QCI, accredits management-system certification bodies in India. This article names no bodies. An accredited ISO 27001 mark is not an AIMS mark. ISO 27001 helps with access and logging. It does not replace the AI inventory.

A European customer may fold AI startup compliance into the same pack as questions under the EU AI Act. The Act has been in force since 1 August 2024. Most Annex III high-risk obligations have applied since 2 August 2026. ISO 42001 does not create a presumption of conformity. It gives you evidence. The DPDP Act, 2023, is a separate clock. As of 31 October 2026 the full fiduciary rulebook is not yet in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. Personal data in prompts still needs a purpose now.

ISO 42001 for startups includes the weeks you spend closing the internal audit, beyond the consultant’s invoice. If the founder cannot attend Stage 1, the ISO 42001 for startups claim was never real.

Ask for a number that matches one product

Startup package pricing is useful when the scope is one product and one site. We will separate consulting, the certification body’s invoice and the founder hours a board never sees on a vendor bill. Write through the contact page: https://www.sevenstepconsulting.com/contact-us/

Price the product you actually ship

If the inventory is still a chat thread, do not buy a bank-shaped program. Ask for startup package pricing. We will scope ISO 42001 for startups to the systems in production and say what the 90 days can and cannot finish.