According to Deloitte’s State of Generative AI in the Enterprise survey (January 2025), 87% of executives say their organisations have AI governance frameworks in place. Fewer than 25% have fully operationalised them. That gap is exactly where ISO/IEC 42001 and ISO/IEC 27001 become relevant, and where the question of how they relate to each other becomes urgent.
For most US enterprise compliance and GRC teams, ISO 27001 is already in the room. It has been since 2013. ISO 42001, published in December 2023, is newer, narrower in scope, and specifically built for the AI systems your organisation is now deploying at scale. The question is not whether you need one or the other. The question is how they fit together, what each actually requires, and how to integrate both without rebuilding your management system from scratch.
This guide covers all of that. By the end, you will know exactly where the two standards diverge, where they share ground, and what a practical integration approach looks like for an enterprise that already carries ISO 27001 certification.
What Each Standard Actually Governs
Start with the scope, because everything else follows from it.
ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). Its core objective is protecting the confidentiality, integrity, and availability of information assets, regardless of the form that information takes. It applies to any organisation that handles sensitive information, which in practice means virtually every enterprise operating today. The 2022 revision brought 93 controls across four themes (Organisational, People, Physical, Technological), replacing the original 114 controls across 14 domains.
ISO/IEC 42001 is the international standard for Artificial Intelligence Management Systems (AIMS). Published in December 2023, it establishes how organisations should govern AI systems across their entire lifecycle: from design and development through deployment, operation, and eventual decommissioning. Its scope extends well beyond information security into territory ISO 27001 was never designed to address: algorithmic fairness, AI transparency, model drift, human oversight, and the accountability of AI-driven decisions that affect real people.
The short version: ISO 27001 secures your information. ISO 42001 governs your AI. These are not the same problem, and solving one does not solve the other.
Where the confusion arises: both standards use risk management as their core methodology, both follow ISO’s High-Level Structure (HLS, sometimes called Annex SL), and both require documented management systems with leadership commitment, internal audits, and continual improvement processes. That structural similarity makes them feel interchangeable at first glance. They are not.
The Shared Foundation: High-Level Structure and Common Processes
ISO’s High-Level Structure is the common framework across all modern ISO management system standards. It gives ISO 27001 and ISO 42001 an identical ten-clause backbone:
| Clause | Topic | ISO 27001 Application | ISO 42001 Application |
| 4 | Context of the organisation | Define ISMS scope, interested parties | Define AIMS scope; also requires defining AI role (provider, deployer, etc.) |
| 5 | Leadership | Information security policy, roles | AI policy, AI-specific roles and responsibilities |
| 6 | Planning | Risk assessment for info security | AI risk and impact assessment (distinct process) |
| 7 | Support | Resources, competence, communication | Resources, AI-specific competence, awareness |
| 8 | Operation | Implement and control security processes | AI system lifecycle controls, impact assessments |
| 9 | Performance evaluation | Monitor, measure, internal audit | AI-specific metrics, performance monitoring |
| 10 | Improvement | Nonconformity, corrective action | AI nonconformity, corrective action |
For organisations already certified to ISO 27001, this structural alignment is genuine practical value. Your existing management system infrastructure, policy framework, internal audit programme, and management review process all carry over. The documentation formats, evidence collection practices, and corrective action workflows translate directly.
A 2025 A-LIGN Compliance Benchmark Report surveying more than 1,000 compliance professionals found that 76% of organisations plan to pursue AI compliance with a framework like ISO 42001 in the near term. Organisations with mature ISO 27001 programmes consistently report a shorter runway to ISO 42001 readiness, because the management system discipline is already established.
Where They Structurally Diverge: The Differences That Actually Matter
Shared structure does not mean shared content. The divergences between the two standards are not subtle. They are architectural.
Risk Scope
ISO 27001’s risk model is built around threats to confidentiality, integrity, and availability. A sophisticated ISO 27001 risk assessment covers data breaches, unauthorised access, system failures, ransomware, insider threats, and the cascading business impact of each.
ISO 42001’s risk model extends into territory that has no direct analogue in information security: algorithmic bias in AI-driven hiring or lending decisions, model drift where AI performance degrades as real-world data distributions shift, opacity in AI decision-making that makes outcomes impossible to explain or challenge, and unintended consequences affecting individuals or groups who may never interact directly with the organisation. An ISO 27001 risk assessment does not surface these categories. They require a separate, AI-specific process.
Annex A: Controls
This is the most concrete difference for implementation teams. ISO 27001’s Annex A contains 93 controls covering access management, cryptography, physical security, incident response, supplier relationships, and dozens of other information security domains.
ISO 42001’s Annex A is a different instrument entirely. Its controls address: AI system impact assessment, data quality and provenance for training data, human oversight mechanisms, transparency and explainability of AI outputs, AI system logging and monitoring, and management of the AI supply chain. These are not variations on ISO 27001 controls. They are distinct requirements for a distinct problem domain.
ISO 42001 also includes Annex B (implementation guidance for Annex A controls, analogous to the role ISO 27002 plays for ISO 27001), Annex C (potential objectives and risk sources for AI systems), and Annex D (sector-specific integration guidance). Advisera’s detailed clause-by-clause analysis notes that Annex D.2 specifically addresses how ISO 42001 integrates with other management systems, including ISO 27001.
Clause 4.1: Organisational Role Definition
ISO 42001 introduces a requirement that has no equivalent in ISO 27001: organisations must formally define their role in the AI ecosystem. Are you an AI provider (developing AI systems for others), an AI deployer (using AI systems in your products or services), or both? This role definition drives which controls apply and at what depth. A financial services firm deploying a third-party credit scoring AI carries different obligations than the AI vendor that built it.
AI System Impact Assessment
ISO 42001 Clause 8.4 requires AI system impact assessments that evaluate the potential effects of AI systems on affected individuals and groups. This is separate from, and more expansive than, a data protection impact assessment (DPIA) under privacy frameworks. The impact assessment considers fairness, transparency, autonomy of the affected parties, and societal effects. There is nothing directly comparable in ISO 27001.
Side-by-Side Comparison: ISO 42001 vs ISO 27001
| Dimension | ISO/IEC 42001 | ISO/IEC 27001 |
| Published | 2023 | 2005; revised 2013, 2022 |
| Primary focus | AI Management System (AIMS) | Information Security Management System (ISMS) |
| Core objective | Responsible, ethical, accountable AI governance | CIA: Confidentiality, Integrity, Availability of information |
| Risk scope | AI-specific: bias, drift, opacity, societal impact | Information security: threats to data and systems |
| Annex A controls | 38 AI-specific controls across 9 domains | 93 information security controls across 4 themes |
| AI lifecycle coverage | Full lifecycle from design to decommissioning | Applies security controls to AI data, not AI governance |
| Unique requirements | Role definition, AI impact assessment, model monitoring | Statement of Applicability, ISMS scope boundary |
| Integration guidance | Annex D.2 explicitly supports multi-standard integration | No AI-specific integration guidance |
| Certification body | Accredited certification bodies (same as ISO 27001) | Established global certification ecosystem |
| Regulatory alignment | EU AI Act, NIST AI RMF | GDPR, HIPAA, various national data protection laws |
How ISO 27001 Certification Accelerates ISO 42001 Readiness
The practical benefit of the HLS alignment: if your organisation holds ISO 27001 certification, you have already built the management system infrastructure that ISO 42001 requires. The question is what additional work the AI standard demands, not whether you have to start over.
Here is what transfers directly:
- Management review process and cadence
- Internal audit programme and methodology
- Document control and records management
- Corrective action and nonconformity management
- Supplier and third-party management framework (requires AI-specific extension)
- Risk register methodology (requires AI-specific risk categories)
- Information security controls for AI system data (already covered under ISO 27001)
Here is what must be built from scratch:
- AI system inventory: a complete registry of every AI system in scope, including third-party AI tools embedded in your technology stack
- AI role definition per Clause 4.1 (provider, deployer, or both)
- AI-specific risk assessment process that captures bias, drift, opacity, and impact categories
- AI system impact assessments per Clause 8.4
- Annex A controls for AI: transparency mechanisms, human oversight procedures, model monitoring, data quality controls for training data
- AI policy framework covering ethical use, accountability, and transparency commitments
The AI system inventory is consistently the hardest part. As implementation guidance from the Cloud Security Alliance (May 2025) notes, AI is embedded in tools that organisations do not always recognise as AI. Spam filters, HR screening platforms, customer analytics engines, fraud detection systems, and recommendation engines may all fall within scope. The inventory must capture them all before meaningful risk assessment can begin.
Building an Integrated Management System: A Practical Integration Approach
The goal of integration is not to merge ISO 27001 and ISO 42001 into a single undifferentiated system. It is to operate both frameworks from a shared management infrastructure while maintaining the distinct processes each standard requires.
Phase 1: Scope and Role Clarity (Weeks 1-4)
Define where ISO 42001 applies relative to your existing ISO 27001 scope. Some organisations will align the scopes entirely; others will define a narrower AI governance scope. Confirm your organisational role under ISO 42001 Clause 4.1. If your organisation both develops and deploys AI systems, document that dual role explicitly, as it determines which controls apply at each phase of the AI lifecycle.
Phase 2: AI System Inventory (Weeks 2-8)
Conduct a comprehensive inventory of AI systems in operation and under development. Map each system to its risk category, relevant ISO 42001 controls, and, where applicable, EU AI Act risk tier. This inventory becomes the foundation for both the AI risk assessment and the Annex A control implementation. It also feeds directly into the AI-specific supplier management requirements, since many AI systems involve third-party models or data providers.
Govern365.ai’s AI model registry is built for exactly this phase. Each AI system in the registry is automatically mapped to applicable ISO 42001 clauses and EU AI Act risk categories, giving compliance teams a live, auditable inventory rather than a spreadsheet that ages from day one.
Phase 3: Risk Assessment Extension (Weeks 4-10)
Extend your existing risk assessment process to include AI-specific categories. This is not a separate risk register it is an extension of your existing framework with AI risk categories appended. Include: algorithmic bias risk, model drift and performance degradation, AI supply chain risk (data providers, model vendors, API dependencies), transparency and explainability risk, and impact on affected individuals or groups.
Phase 4: Control Implementation (Weeks 8-20)
Implement the ISO 42001 Annex A controls applicable to your organisational role and risk profile. Organisations are not required to implement all 38 controls; the Statement of Applicability process (directly analogous to ISO 27001’s SoA) documents which controls apply and why. Prioritise controls where AI risk is highest: Clause 8.4 impact assessments for high-risk AI systems, human oversight mechanisms for AI systems making consequential decisions, and monitoring and logging for deployed models.
Phase 5: Unified Audit Programme (Ongoing)
Expand your internal audit schedule to cover ISO 42001 AIMS requirements alongside ISO 27001 ISMS requirements. Many organisations run a combined audit for the management system processes (Clauses 4-10) and separate technical audits for Annex A controls given the distinct domain expertise required. Your existing ISO 27001 audit evidence collection practices translate directly; the AIMS audit adds AI-specific evidence collection around model performance metrics, impact assessment records, and oversight logs.
ISO 42001 in the US Regulatory Context: EU AI Act and NIST AI RMF
For US enterprises, the regulatory picture involves two frameworks that ISO 42001 aligns with directly.
The NIST AI Risk Management Framework (AI RMF 1.0), published by the National Institute of Standards and Technology in January 2023, organises AI governance across four functions: Govern, Map, Measure, and Manage. ISO 42001 and the NIST AI RMF are not competing frameworks. They are structurally complementary. ISO 42001 provides the certifiable management system; the NIST AI RMF provides a detailed operational playbook. Organisations implementing ISO 42001 will find that the NIST AI RMF’s Map and Measure functions provide practical tooling for the AI risk assessment and monitoring requirements in ISO 42001 Clauses 6.1 and 9.1.
The EU AI Act, which entered into force in August 2024 with phased compliance deadlines through 2026, applies to any organisation deploying AI systems that affect EU residents, including US enterprises serving European customers or operating EU subsidiaries. ISO 42001 certification does not equal EU AI Act compliance, but the overlap is substantial. The Act’s Article 9 risk management requirements align closely with ISO 42001 Clause 6.1 controls. The Act’s transparency and human oversight requirements (Articles 13-14) map directly to ISO 42001 Annex A controls on explainability and oversight mechanisms.
For US enterprises managing multi-jurisdictional AI compliance, ISO 42001 certification creates a documented, auditable governance baseline that satisfies or substantially informs compliance with the EU AI Act, emerging US state AI regulations, and sector-specific requirements in healthcare (FDA guidance on AI-based medical devices) and financial services (OCC, CFPB expectations on algorithmic decision-making).
Which Standard Do You Need? A Decision Framework
The honest answer to this question depends on what your organisation actually does with AI.
| Situation | What You Need |
| You handle sensitive information but use little or no AI | ISO 27001 only |
| You develop or deploy AI systems but have no significant information security programme | ISO 42001 now; ISO 27001 should follow |
| You develop or deploy AI systems and already hold ISO 27001 | Extend to ISO 42001 using your existing management system infrastructure |
| You serve EU customers or operate EU subsidiaries with AI systems | ISO 42001 + EU AI Act compliance programme; ISO 27001 if not already held |
| You supply AI-powered products or services to regulated industries or government | Both, and likely sector-specific frameworks on top |
| Your board or major customers require demonstrable AI governance | ISO 42001 certification is the most internationally recognised answer |
One data point worth noting: a 2026 analysis from AI Governance Today reported that 83% of Fortune 500 procurement teams plan to require ISO 42001 alignment by 2027. For enterprise software and AI vendors, this is not an abstract governance question. It is a sales and contracting reality that is arriving faster than most compliance roadmaps anticipate.
Frequently Asked Questions
Does ISO 27001 certification cover AI systems?
Partially. ISO 27001 covers the security of information used by AI systems, including training data, model outputs, and access controls around AI infrastructure. It does not address AI-specific governance requirements: algorithmic fairness, model drift, transparency, human oversight, or the impact of AI decisions on affected individuals. For organisations deploying AI, ISO 27001 is necessary but not sufficient.
Can ISO 42001 and ISO 27001 be audited together?
Yes, and most organisations with both standards opt for a combined audit approach. The management system processes (Clauses 4-10) are structurally identical and can be audited in a single pass. The Annex A controls require separate technical expertise: information security auditors for ISO 27001 controls and AI governance specialists for ISO 42001 controls. Many certification bodies now offer dual-standard audit programmes that sequence the technical portions accordingly.
If we already have ISO 27001, how long does ISO 42001 certification take?
Organisations with mature ISO 27001 programmes typically reach ISO 42001 readiness in 6-12 months, compared to 12-18 months for organisations without a prior management system baseline. The primary time investment is the AI system inventory and the AI risk assessment process, not the management system documentation. Teams that underestimate the inventory phase consistently experience the longest delays.
Does ISO 42001 certification satisfy EU AI Act requirements?
ISO 42001 certification substantially supports EU AI Act compliance but does not substitute for it. The EU AI Act imposes specific obligations by AI risk tier (unacceptable, high, limited, minimal) with mandatory conformity assessments for high-risk systems. ISO 42001 provides the governance infrastructure and risk management processes that EU AI Act compliance programmes build on, and demonstrable ISO 42001 certification strengthens the case for regulatory compliance. Always verify obligations with qualified legal counsel.
What is the difference between an ISMS and an AIMS?
An Information Security Management System (ISMS) is the structured set of policies, processes, and controls that an organisation operates to protect information assets. An AI Management System (AIMS) is the equivalent structure for governing AI systems: defining how AI is assessed, deployed, monitored, and decommissioned responsibly. Both are management systems in the ISO sense; they can operate in parallel from a shared organisational infrastructure while maintaining distinct processes for their respective domains.
Do we need ISO 42001 if we only use third-party AI tools (not build our own)?
Yes, ISO 42001 applies to AI deployers, not just AI developers. If your organisation uses AI systems to make or inform decisions, whether those systems are internally built or third-party products, you carry governance obligations for how those systems are selected, configured, monitored, and overseen. ISO 42001 Clause 4.1 distinguishes between provider and deployer roles and assigns controls to each. Deployers are not exempt; they have a distinct, defined set of obligations.
Conclusion
ISO 42001 and ISO 27001 are not competing standards. They are complementary frameworks designed for distinct problem domains that increasingly intersect in any organisation running AI at scale. ISO 27001 secures the information environment. ISO 42001 governs the AI systems operating within it. Enterprises need both, and the structural alignment between them means that building one is a meaningful head start on the other.
The next step for most organisations is the AI system inventory: a complete, auditable catalogue of every AI system in scope, mapped to applicable controls and risk categories. That inventory is where ISO 42001 programmes either gain momentum or stall.Govern365.ai, by the Global AI Certification Council, gives GRC teams the AI model registry, risk assessment workflows, and compliance dashboards to build and maintain that inventory, and to carry it through to certification. Start your 14-day free trial and see how far your existing ISO 27001 programme already takes you.
