ISO 42001 vs ISO 27001: How the Two Standards Differ and Fit Together

What is ISO 27001?

ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current edition, ISO/IEC 27001:2022, requires an organisation to define the scope of its ISMS, assess information security risks, select controls to treat them and keep the system under continual improvement. An accredited certification body can audit an organisation against it. The official page is at iso.org.

The focus is the confidentiality, integrity and availability of information, whatever technology holds it. In practice the standard covers policies, risk management, access control, supplier security, incident handling, business continuity and the evidence that all of this actually operates.

What is ISO 42001?

ISO/IEC 42001:2023 is the first international standard for an AI management system (AIMS). It was published in December 2023 and, like ISO 27001, it is certifiable. The standard is listed on iso.org.

Where ISO 27001 protects information, ISO 42001 governs the way an organisation develops, provides or uses AI systems. It asks for an AI policy, defined roles, an assessment of the impact of AI systems on individuals and society, controls across the AI system life cycle, and attention to data quality, transparency and third parties. It applies whether you build models or only use AI services from suppliers.

What is the difference between ISO 42001 and ISO 27001?

The core difference is scope. ISO 27001 manages information security risk. ISO 42001 manages AI-specific risk, which includes security but extends well beyond it.

• Object of control: ISO 27001 protects information assets. ISO 42001 governs AI systems and the organisational processes around them.
• Risk lens: ISO 27001 asks what could harm the confidentiality, integrity or availability of information. ISO 42001 also asks what could harm people or the organisation through the behaviour of an AI system, such as bias, lack of transparency or unsafe outputs.
• Impact assessment: ISO 42001 expects structured assessment of AI system impact. ISO 27001 has no equivalent requirement for societal impact.
• Life cycle: ISO 42001 addresses design, development, testing, deployment, monitoring and retirement of AI systems. ISO 27001 is technology neutral and does not prescribe a development life cycle.
• Typical owner: an ISMS usually sits with the security function. An AIMS needs input from data science, legal, risk and the business owners of AI use cases.

An organisation can hold ISO 27001 and still have no governance over how its teams use generative AI. That gap is what ISO 42001 is designed to close.

The reverse is also true. A mature AI governance programme that ignores information security leaves training data, prompts, model access and logs exposed. For most organisations the sensible question is therefore not which standard to choose, but in which order to build them and how much of the work can be shared.

What structure do the two standards share?

Both standards follow the harmonised structure that ISO uses for management system standards. The main clauses cover context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. Core mechanisms such as the policy, risk assessment, internal audit, management review and corrective action are therefore built in the same way.

This shared skeleton is the reason combination is practical. A document control process, an internal audit programme and a management review meeting can serve both systems. What changes is the content you put into each clause: information security risks in one case, AI risks and impacts in the other.

How do the Annex A controls compare?

Both standards include an Annex A with a reference set of controls. ISO/IEC 27001:2022 Annex A contains 93 controls grouped into four themes: organisational, people, physical and technological. They cover areas such as access control, cryptography, logging, supplier relationships, secure development and incident management.

The Annex A of ISO 42001 is organised into control objectives that are specific to AI. In broad terms they address:

• policies related to AI and the internal organisation that owns them
• resources for AI systems, including data, tooling and people
• assessing the impact of AI systems
• the AI system life cycle
• data for AI systems
• information for interested parties
• responsible use of AI systems
• third party and customer relationships

Several ISO 27001 controls remain relevant to AI, for example supplier security, secure development and logging. ISO 42001 adds the AI-specific layer on top. Neither standard replaces the other, and the exact control wording should always be taken from the published text.

Can both be combined into one management system?

Yes. Because both use the harmonised structure, many organisations build an integrated management system rather than two parallel ones. A typical approach looks like this:

1. Keep one management system document set with shared governance, document control and internal audit procedures.
2. Extend the existing risk methodology so that it covers AI risks and impact assessment alongside information security risks.
3. Map overlapping controls once, such as supplier management, access control and logging, and show the AI-specific additions separately.
4. Maintain a single management review that reports on both information security and AI governance.
5. Align the scope statements so that the AI systems in scope also sit inside the security perimeter of the ISMS.

If you already operate an ISMS, you are usually not starting from zero. A useful reference for the security side is our article on which ISO 27001 controls a Kubernetes architecture satisfies. For a first review of your current security evidence, see our information security audit service.

How does certification work?

Both standards are audited by accredited certification bodies in stages: a documentation and readiness review, followed by an assessment of how the system operates in practice. Certificates are normally valid for a fixed cycle with surveillance audits in between. Certification bodies can often audit two standards at the same time, which reduces duplicated effort for an integrated system.

Certification demonstrates that a management system exists and operates against the standard. It does not prove that every AI system is safe or that an organisation meets any particular law. Regulation such as the EU AI Act, Regulation (EU) 2024/1689, is a separate legal obligation that you can read on EUR-Lex. A management system can support the evidence you need, but it is not a substitute for a legal assessment.

The voluntary NIST AI Risk Management Framework is a further reference point for AI risk practices and is available from NIST.

How Krasper helps

Krasper Technologies advises regulated organisations in the UAE, the GCC and the EU. Our AI governance consulting helps you define scope, roles, risk methodology and an inventory of AI systems that an AI management system can build on. Where you already run an ISMS, we look at how to extend it rather than replace it.

For the evidence side, Raigate is a self-hosted AI governance platform that records policy decisions and audit trails for AI traffic. It supports evidence for your management system. It does not certify an organisation or guarantee compliance.