ISO 42001 and ISO 27001 compared
If you already hold ISO 27001, much of the management-system work can transfer to ISO 42001. You still need to identify your AI-specific risks, define responsibilities and assess impacts on individuals and society.
What to know
- ISO 42001 and ISO 27001 use the same harmonised management-system structure. The familiar clauses 4 to 10 cover areas such as leadership, planning, support, operation, evaluation and improvement. You can often reuse existing policies, records and audit evidence where they address both standards.
- The controls themselves do not transfer across unchanged. ISO 27001 Annex A focuses on information security, while ISO 42001 Annex A addresses AI policy and governance. You will need to add controls for AI impact assessments, the AI life cycle, data provenance and relevant third parties.
- ISO 42001 adds an AI-system impact-assessment requirement. That assessment considers effects on individuals and society, alongside risks to the organisation. The scope is broader because AI systems can affect people outside your business.
- Accreditation applies to the specific standard. A body accredited for ISO 27001 is not automatically accredited for ISO 42001, and some certification bodies hold accreditation for only one of the two standards. Check both before you choose a provider.
- Many certification bodies can audit ISO 27001 and ISO 42001 in one visit. A combined audit can reduce duplicated work and audit costs. Confirm that the body is accredited for both standards and can offer an integrated audit before you commit.
The same spine, a different body
An ISO 27001 management system gives you much of the structure ISO 42001 requires. You will already have experience defining scope, assigning leadership responsibilities and managing risk. The same applies to competence, documented information, internal audits, management reviews and corrective action.
The clause structure is familiar, and many existing documents can be adapted rather than replaced. Policies, procedures and records usually need additions that reflect how your organisation develops, buys or uses AI.
The focus changes. ISO 27001 protects information and manages risks to the organisation. ISO 42001 examines how AI systems behave, the consequences they create and the people affected by them. Its risk assessment therefore looks beyond the organisation, including impacts on individuals and society.
That outward view is often the biggest adjustment for an ISO 27001 team. The management-system machinery may feel familiar, but the questions it must answer are different.
ISO 42001 vs ISO 27001 compared
Assuming you hold a current ISO 27001 certificate.
| Requirement | ISO 27001 | ISO 42001 | Reusable? |
|---|---|---|---|
| Clauses 4 to 10 structure | Yes | Same | Almost entirely |
| Scope definition | Information assets | AI systems and roles | Structure yes, content no |
| Risk assessment process | Risk to information | Risk from AI, outward facing | Process yes, criteria no |
| Internal audit and management review | Yes | Same, AI scope | Almost entirely |
| Competence and awareness | Yes | Same, AI competence | Process yes, evidence no |
| Supplier and third-party controls | Information security focus | AI supply chain and model provenance | Partly |
| Annex A controls | 93 controls, security | 38 controls, AI governance | No |
| Impact assessment on people | Not required | Required | No |
| Accreditation | Held separately | Held separately | No |
What an ISO 27001 holder still has to build for ISO 42001 compliance
-
01
An AI system inventory
List the AI systems your organisation develops, buys or uses to make decisions. Record each system's role in the organisation. Many teams find systems they did not know they were using once they carry out this exercise. -
02
An AI system impact assessment
Assess how each relevant system may affect individuals and groups. ISO 27001 does not provide an equivalent requirement, and this is one of the areas auditors are likely to examine most closely. -
03
AI-specific risk criteria
Your ISO 27001 risk process can provide the structure, but its current measures will not cover everything ISO 42001 asks you to consider. Add criteria for issues such as fairness, transparency, human oversight and safety, alongside information-security risks. -
04
Data provenance for training and inference
Record where training and inference data comes from, how your organisation is permitted to use it, and how you maintain its quality. Keep that record current throughout the AI system's life cycle. -
05
Life-cycle controls
Define controls for design, development, verification, deployment, monitoring and retirement. Model change control also needs its own treatment. It does not work in exactly the same way as changing a server or another information-security asset. -
06
Information for affected people
Explain to affected individuals when AI has influenced a decision or process, where that applies. Set out how they can challenge the organisation's use of AI or ask for that involvement to be considered.
Auditing ISO 42001 & ISO 27001 together
Most certification bodies can audit ISO 42001 and ISO 27001 in one visit. Some can add ISO 9001 or SOC 2 where that fits your existing assurance programme.
An integrated audit can reduce audit days, repeated disruption for your team and the overall cost. The saving depends on how the body combines the work. Simply adding the full duration for both standards creates no efficiency.
Ask the certification body to confirm:
- whether it holds accreditation for both ISO 42001 and ISO 27001;
- how it calculates the integrated-audit days;
- which evidence and interviews can be shared;
- whether the expected reduction justifies the integrated-audit cost.
Accreditation applies one standard at a time, so a body that audits ISO 27001 cannot automatically issue an accredited ISO 42001 certificate. Check the accreditation schedule before you agree the scope.
Questions people ask
How much faster is ISO 42001 certification if we hold ISO 27001?
+
Holding ISO 27001 usually shortens the management-system work. Organisations report implementation in months rather than a year, because they can reuse established processes for scope, leadership, risk and documented information.
It does not remove the AI-specific work. Building an inventory of the AI you develop, buy or use can take substantial time, as can assessing its impacts and risks.
Can we extend our existing ISO 27001 certificate rather than get a new one?
+
You need separate certificates because ISO 27001 and ISO 42001 are separate standards. You cannot extend an ISO 27001 certificate to cover ISO 42001.
The standards can share much of the underlying management system, however. A certification body may cover both in one audit visit, provided it is accredited for both standards.
Our certification body does ISO 27001. Can they do ISO 42001?
+
Your certification body can audit ISO 42001 only if it holds accreditation for that standard. Accreditation applies separately to each standard, so ISO 27001 accreditation does not automatically include ISO 42001.
Ask the body for its accreditation schedule and check that it names ISO/IEC 42001 as well as ISO 27001. Some bodies can certify ISO 27001 but do not yet hold ISO 42001 accreditation.
Should we do ISO 42001 or ISO 27001 first?
+
ISO 27001 usually comes first. Customers commonly request it, and it establishes the management system that ISO 42001 can build on.
That does not complete the ISO 42001 work. You still need to address the AI-specific risks, impacts, responsibilities and controls covered by that standard.
Do the 93 information-security controls help at all?
+
Yes. Existing access controls, logging controls and supplier controls can carry across, and you may be able to reuse them as evidence.
ISO 42001 also includes AI-specific controls in Annex A. ISO 27001 has no equivalent for those controls, so your existing information-security controls will not cover the whole ISO 42001 assessment.
Find a body accredited for both standards
Our ranking identifies certification bodies that can audit ISO/IEC 42001 and ISO 27001. It also shows which bodies can cover both standards, so you can ask about a combined audit in one visit. Use the ranking to build a shortlist, then confirm that the body holds accreditation for each standard before you commit. A body accredited for ISO 27001 cannot automatically issue an accredited ISO 42001 certificate.