AI Compliance Vendors

Standards compared

ISO 42001 vs ISO 27001: differences, overlap and how to integrate them

ISO/IEC 27001 is the certifiable standard for an information security management system; ISO/IEC 42001 is the certifiable standard for an AI management system. They share the same harmonized clause structure, so an organization with ISO 27001 can extend its existing system to cover AI, but each has its own Annex A controls (93 in ISO 27001:2022, 38 in ISO 42001) and neither certificate covers the other [5][6][7]. This guide compares them side by side, shows what transfers from an ISO 27001 program and what is new, sets out an integrated implementation plan, and names certification bodies that audit both.

Reviewed 5 Nov 2026 · next review by 5 Mar 2027 · 23 sources · report an error

ISO 42001 vs ISO 27001: the short answer

ISO/IEC 27001 asks how you protect information. ISO/IEC 42001 asks how you govern AI: whether the AI systems you build, sell or use are designed, deployed, monitored and explained responsibly, and what they could do to people and society [5][7]. Security of an AI system is part of the answer to the second question, but most of 42001 is about things 27001 never asks, such as AI system impact assessments, training data provenance and information for users.

What they share is the frame. ISO/IEC 42001 “applies the harmonized structure” used by ISO management system standards and says it is designed to work with standards on quality, safety, security and privacy [5]. Clauses 4 to 10 carry the same numbers and core text, so policy management, internal audit, management review and corrective action can be run once for both [5].

ISO 42001 and ISO 27001 side by side

ISO/IEC 42001:2023 and ISO/IEC 27001:2022 compared
ISO/IEC 27001:2022ISO/IEC 42001:2023
PurposeRequirements for an information security management system (ISMS) [3]Requirements for an AI management system (AIMS) [1]
Who it is forOrganizations that want a certifiable information security management system [3][8]Organizations that develop, provide or use AI [10]
PublishedOctober 25, 2022; Amendment 1 (climate action changes) February 2024 [3][4]December 18, 2023; edition 1, no amendment [1][2]
Length and price19 pages; €149.00 excl. VAT at NSAI; the amendment is free [3][4]51 pages; CHF 225 at ISO and the IEC [1][2]
StructureHarmonized structure, clauses 4 to 10 [21]Harmonized structure, clauses 4 to 10 [5]
Annex A93 controls in four themes: organizational, people, physical and technological; normative [6][21]38 controls in 9 areas, A.2 to A.10 [7][23]
Core assessmentsInformation security risk assessment (6.1.2) and risk treatment (6.1.3) [21]AI risk assessment, AI risk treatment and AI system impact assessment [7]
Rules for certification bodiesISO/IEC 27006-1:2024, complementing ISO/IEC 17021-1 [8]ISO/IEC 42006:2025, supplementing ISO/IEC 17021-1 [9]
Certificate cycleThree years, surveillance audits each year, recertification before expiry [11]Same three-year cycle [11]
Legal statusVoluntary; certified by independent certification bodies [8]Voluntary; ISO does not certify organizations itself [10]
ISO 42001 also has three further annexes: Annex B implementation guidance (normative), and Annex C on objectives and risk sources and Annex D on use across sectors (both informative) [5].
93
Annex A controls in ISO/IEC 27001:2022, down from 114 in the 2013 edition[6]LRQA, on the 2022 edition
38
Annex A controls in ISO/IEC 42001:2023, in 9 areas[7]LRQA checklist, 2023 edition
11
New controls added in ISO/IEC 27001:2022[6]LRQA, on the 2022 edition
CHF 0
Price of ISO/IEC 27001’s 2024 climate amendment; 42001 has none[4]ISO catalog, November 2026

What transfers from an existing ISO 27001 program?

Because both standards use the harmonized structure [5], most of the management system carries over. The table is our clause-by-clause mapping of what an ISO 27001 holder can reuse and what has to change. It is a planning aid, not an auditor’s ruling.

ISMS elements reused for ISO 42001, and what changes
ISMS elementReuse for 42001?What changes for AI
Clause 4: context, interested parties, scopePartlyAdd AI-specific issues and stakeholders, decide your role for each AI system (for example provider or customer), and write an AIMS scope that names the AI systems covered [5]
Clause 5: leadership, policy, rolesPartlyA separate AI policy aligned with your other policies, and named owners for AI governance (A.2, A.3) [7]
Clause 6: risk methodPartlyKeep the scoring scales and treatment workflow; add AI risk criteria and AI risk sources, and add the AI system impact assessment [7]
Risk treatment output (6.1.3)Format onlyA 42001 Statement of Applicability against its 38 controls, with its own justifications for exclusions [7]
Clause 7: competence, awareness, documented informationYesExtend training to AI roles; use the same document control
Clause 8: operational planning and controlPartlyRun AI risk and impact assessments at planned intervals and on significant change [7]
Clause 9: internal audit, management reviewYesOne audit programme and one management review can cover both, with AI agenda items
Clause 10: nonconformity, corrective actionYesSame corrective action log
Asset inventoryPartlyBecomes the basis of an AI system inventory and resource documentation (A.4) [7]
Supplier security controlsPartlyExtend to AI suppliers and customers, with responsibilities allocated across the AI value chain (A.10) [7]
Logging and monitoring controlsPartlyAdd AI-specific operation and monitoring and event logging for AI systems (A.6) [7]
Clause numbers follow the harmonized structure shared by both standards [5]. Annex A references are ISO 42001 control areas as titled by LRQA [7].

What is new in ISO 42001 for an ISO 27001 team?

Expect most of the effort to go into four areas that have no real counterpart in an ISMS.

  • AI system impact assessment. An outward-looking assessment of what an AI system could do to individuals, groups and society, documented and fed into the risk assessment (A.5) [7]. ISO/IEC 42005:2025 gives detailed guidance and costs CHF 181 [13].
  • The AI system life cycle. Controls for responsible design, requirements, verification and validation, deployment, operation, monitoring and technical documentation of AI systems (A.6) [7]. An ISMS secures systems; 42001 asks whether they were built and released responsibly.
  • Data for AI systems. Data acquisition, quality, provenance and preparation for training and operation (A.7) [7]. ISO 27001 protects data; 42001 asks whether it is fit to train or run a model.
  • Third parties and customers. Allocating responsibilities with AI suppliers and customers (A.10) [7]. This goes beyond supplier security reviews to who is responsible for what an AI system does.

Two smaller areas round it out: information for interested parties, including incident communication (A.8), and processes and objectives for the responsible use of AI systems (A.9) [7]. For the full control list, see our ISO 42001 guide; for risk method, ISO/IEC 23894 applies ISO 31000 to AI and pairs well with an existing ISMS risk process.

How to integrate ISO 42001 into an ISO 27001 management system

A suggested order of work for an organization that already holds ISO 27001. Timings vary with the number of AI systems in scope, so we give none.

  1. 01

    Buy the standard and run a gap analysis

    Get a licensed copy (see where to buy ISO 42001) and compare your ISMS with clauses 4 to 10 and the 38 Annex A controls using our free ISO 42001 checklist.

  2. 02

    Inventory your AI systems

    Start from the ISMS asset register. List every AI system you build, sell or use, your role for each, and its data, tooling and owners (A.4) [7].

  3. 03

    Set the AIMS scope next to the ISMS scope

    Decide whether the AIMS covers the same units and sites. Matching scopes make combined audits and one management review simpler.

  4. 04

    Write the AI policy and assign roles

    Add an AI policy that aligns with your information security policy, and name AI governance owners and a route for reporting concerns (A.2, A.3) [7].

  5. 05

    Extend the risk method

    Add AI risk criteria and AI risk sources to your existing method, and add the AI system impact assessment as a new step that feeds it [7]. ISO/IEC 23894 and ISO/IEC 42005 are the guidance documents for each [13][15].

  6. 06

    Write the 42001 Statement of Applicability

    Select controls from 42001’s Annex A and justify every exclusion. Keep it separate from the 27001 SoA or as a second part of one document [7].

  7. 07

    Implement the AI-only controls

    Life cycle, data, information for users and third-party controls (A.6 to A.10) are where new evidence will come from [7]. Reuse ISMS controls for the security of AI systems.

  8. 08

    Run one internal audit programme and one management review

    Cover both standards in the same cycle, with AI items on the management review agenda.

  9. 09

    Choose a certification body accredited for both

    Check the accreditation directory for each standard, and ask whether audits can be coordinated. See who audits both.

Budget audit days separately for each standard: certification bodies follow ISO/IEC 27006-1 for the ISMS and ISO/IEC 42006 for the AIMS [8][9]. Our ISO 42001 certification cost calculator lowers its implementation estimate when ISO 27001 is already in place, and the certification guide covers Stage 1 and Stage 2.

Which certification bodies certify both ISO 27001 and ISO 42001?

Many certification bodies offer both. We list only those whose own pages, or own press release, show accreditation or certification services for both standards when we checked on November 5, 2026. Always confirm in the accreditation body’s directory.

Certification bodies that show both ISO/IEC 27001 and ISO/IEC 42001 (checked November 5, 2026)
Certification bodyISO/IEC 27001ISO/IEC 42001Combined audits
SchellmanAccredited by ANAB and UKAS [16]Describes itself as the first ANAB-accredited certification body for ISO 42001 [17]Its ISO 42001 page lists integration with an existing management system certification as an FAQ topic, answered on video [17]
A-LIGNDescribes itself as dual-accredited by ANAB and UKAS [18]Announced ANAB accreditation for ISO 42001 in October 2024 [19]Says customers can harmonize their ISO 27001 audit with other compliance work [18]
BARR CertificationsANAB-accredited [14]ANAB-accredited [14]Announced coordinated audits for ISO 27001, ISO 27701 and ISO 42001 in one engagement, March 3, 2026 [14]
Examples, not a ranking or a complete list. Compare more firms on our ISO 42001 audit firms page.

Coordinated or combined audits share an audit team and a timeline; BARR, for example, says its approach is meant to cut duplicated work [14]. You still receive one certificate per standard, and each standard’s audit time is set under its own rules [8][9].

Which should you get first?

  • You sell software and customers ask about security. ISO 27001 (or SOC 2) is usually the first request. Add 42001 when AI features become central to the product or customers start asking AI governance questions. See SOC 2 vs ISO 42001.
  • You build AI models or AI-first products. Consider 42001 early, and plan the ISMS alongside it, since much of the management system is shared [5].
  • You already hold ISO 27001. Extending to 42001 is the cheaper route to an AI certificate, because clauses 4 to 10 are already running [5].
  • You sell high-risk AI into the EU. Neither certificate is AI Act conformity [12]. The first harmonised AI Act standard is EN 18286:2026 on quality management, cited on October 14, 2026 [20].

Our ranking of ISO 42001 software compares platforms that hold both Statements of Applicability and share evidence across frameworks.

Related guides and tools

Advertise on this page

Frequently asked questions

+What is the difference between ISO 42001 and ISO 27001?

ISO 27001 sets requirements for an information security management system; ISO 42001 sets requirements for an AI management system [1][3]. They share the harmonized clause structure, but 42001 adds AI risk and impact assessments and its own 38 Annex A controls, against 27001’s 93 [5][6][7].

+Does ISO 27001 cover AI?

Only the security of AI systems, as information systems. It does not ask for AI impact assessments, AI life cycle controls or data quality for AI, which are what ISO 42001 adds [7]. A separate ISO 42001 certificate is needed to show AI governance.

+Can ISO 42001 and ISO 27001 be integrated?

Yes. ISO 42001 applies the harmonized structure and is designed to be compatible with other management system standards, including security [5]. One set of policies, one internal audit programme and one management review can serve both, with a separate Statement of Applicability for each.

+Can you get one certificate for ISO 27001 and ISO 42001?

No. Each standard is certified separately, under its own certification body rules: ISO/IEC 27006-1 for 27001 and ISO/IEC 42006 for 42001 [8][9]. Some bodies coordinate the audits into one engagement [14].

+How many controls are in ISO 42001 compared with ISO 27001?

ISO/IEC 42001 has 38 Annex A controls in 9 areas, A.2 to A.10 [7][23]. ISO/IEC 27001:2022 has 93 controls in four themes, down from 114 in the 2013 edition [6]. In ISO 42001 you select the controls you need and justify exclusions in a Statement of Applicability [7].

+Do I need ISO 27001 before ISO 42001?

No. ISO 42001 can be implemented on its own, and certification body LRQA says ISO 27001 certification is not mandatory, though it gives a strong foundation [22]. Having ISO 27001 makes it faster because clauses 4 to 10 are already in place [5].

+Is ISO 42001 harder than ISO 27001?

It has fewer controls, 38 against 93 [6][7], but its new assessments and life cycle, data and third-party controls are less familiar to most teams [7]. Effort depends mainly on how many AI systems are in scope.

+Which certification bodies audit both ISO 27001 and ISO 42001?

Examples whose own pages show both include Schellman, A-LIGN and BARR Certifications [14][16][17][18][19]. Check each body’s accreditation in the ANAB or UKAS directory before you sign.

Sources

  1. [1]ISO, ISO/IEC 42001:2023, Information technology — Artificial intelligence — Management system (catalog page) (2023-12).
  2. [2]IEC, IEC Webstore: ISO/IEC 42001:2023 (2023-12-18).
  3. [3]NSAI Standards Store (Intertek Inform), ISO/IEC 27001:2022 (2022-10-25).
  4. [4]ISO, ISO/IEC 27001:2022/Amd 1:2024, Climate action changes (2024-02).
  5. [5]ISO/IEC via iTeh Standards, ISO/IEC 42001:2023 official sample (introduction and contents).
  6. [6]LRQA, ISO/IEC 27001:2022 published.
  7. [7]LRQA, ISO 42001 checklist.
  8. [8]ISO, ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of information security management systems, Part 1: General (2024-03).
  9. [9]ISO, ISO/IEC 42006:2025, Requirements for bodies providing audit and certification of AI management systems (2025-07).
  10. [10]ISO, ISO/IEC 42001 explained: what it is (2026-08-31).
  11. [11]Bureau Veritas, Certification process (three-year cycle, surveillance and recertification).
  12. [12]European Commission, Understanding standardisation under the AI Act (FAQ) (2026-03-10).
  13. [13]ISO, ISO/IEC 42005:2025, AI system impact assessment (2025-05).
  14. [14]BARR Certifications, via Business Wire, BARR Certifications announces coordinated audits for the “ISO Trifecta” (2026-03-03).
  15. [15]ISO, ISO/IEC 23894:2023, Guidance on risk management (2023-02).
  16. [16]Schellman, ISO certifications.
  17. [17]Schellman, ISO 42001 certification.
  18. [18]A-LIGN, ISO 27001 certification.
  19. [19]A-LIGN, A-LIGN achieves ISO 42001 accreditation (2024-10-23).
  20. [20]Official Journal of the EU, Commission Implementing Decision (EU) 2026/2274 on harmonised standards for high-risk AI systems (EN 18286:2026) (2026-10-14).
  21. [21]ISO/IEC via iTeh Standards, ISO/IEC FDIS 27001:2022 sample (foreword, introduction and contents) (2022).
  22. [22]LRQA, ISO/IEC 42001 certification FAQ.
  23. [23]BSI, ISO/IEC 42001:2023 AI Controls Implementation training guide (38 Annex A controls, sections A.2 to A.10) (2025).

How we keep this page current

Every claim links to its source. We re-check this page at least every 120 days, and sooner when a standard, law or vendor changes; vendor names, acquisitions and shutdowns update automatically from our directory. Vendors cannot pay to be included or ranked.