ISO 27090 vs ISO 42001 (and Where ISO 27001 Fits)

If you are weighing ISO 27090 vs ISO 42001, the short answer is that you are not choosing between them. ISO/IEC 42001 is a certifiable management system for AI; ISO/IEC 27090 is security guidance for the AI systems that management system governs. If you are serious about AI, plan for both, alongside ISO/IEC 27001 where you already run an ISMS.

This guide sets out what each standard does, where they overlap, where they do not, and how to run them together without building the same control twice.

What this guide covers

• ISO 27090 vs ISO 42001 in one table
• What ISO 42001 does that ISO 27090 does not
• What ISO 27090 does that ISO 42001 does not
• Where ISO 27001 fits
• Running ISO 27090 and ISO 42001 together
• How ISO 27090 vs ISO 42001 lines up control by control
• Who owns what when you run ISO 27090 vs ISO 42001 side by side
• Which to start with
• Common misconceptions about ISO 27090 vs ISO 42001
• Getting both right

ISO 27090 vs ISO 42001 in one table

What ISO 42001 does that ISO 27090 does not

ISO 42001 is a management system standard, built on the same harmonised structure as ISO 27001. It requires an AI policy, roles, objectives, risk assessment and treatment, AI system impact assessment, a Statement of Applicability against its Annex A, internal audit and management review. It asks how AI affects individuals and society, not only whether the AI is secure.

None of that is in ISO 27090, and this is the biggest practical difference in ISO 27090 vs ISO 42001. It has no management system clauses, no impact assessment, no audit requirement and no Statement of Applicability. If a customer or regulator wants a certificate that shows your AI is governed, ISO 42001 is the answer.

What ISO 27090 does that ISO 42001 does not

ISO 42001 touches security in a handful of Annex A controls, for example on data provenance, system operation and monitoring, and suppliers. It does not tell you what a poisoning attack looks like, how membership inference leaks training data, how to defend an LLM against indirect prompt injection, or how to scope an agent’s privileges.

That is exactly what ISO 27090 does. For each compromise type it describes the attack, the failure it causes, how to detect it and how to mitigate it. It adds AI-specific guidance on zero trust, supply chain, threat modelling, red teaming, provenance, continuous validation and the way mitigations interfere with each other. The ISO 27090 guide covers that structure in detail.

Where ISO 27001 fits

ISO 27001 is the third corner, and in practice the foundation. ISO 27090 says plainly that conventional information security controls apply to AI systems first; its own first requirement is to apply controls such as those in ISO/IEC 27002, chosen by risk assessment. If you already run an ISO 27001 ISMS, the AI-specific risks from ISO 27090 go into that risk assessment and the resulting controls into your Statement of Applicability.

We cover the 27001 and 42001 pairing separately in ISO 27001 vs ISO 42001. Adding ISO 27090 does not create a third management system; it deepens the security content of the two you have.

Running ISO 27090 and ISO 42001 together

Comparing ISO 27090 vs ISO 42001 is only half the job; the other half is running them together. The risk with three frameworks is duplication: the same control written three ways, owned by three people. A simple rule avoids it. Each topic has one primary home, and the others reference it.

Two practical consequences follow. First, add the AI compromise types from ISO 27090 to the risk assessment you already run, rather than starting a separate AI security register. Second, when ISO 42001 asks you to treat an AI risk that is a security risk, point to the ISO 27090-based control rather than writing a new one.

How ISO 27090 vs ISO 42001 lines up control by control

The clearest way to see how the two fit is to take the ISO 27090 threats and ask which ISO 42001 Annex A control each one supports. The mapping below is our interpretation of intent, not a table from either standard, but it shows the pattern: ISO 42001 names the control area, ISO 27090 supplies the security substance inside it.

Read the table from right to left and it becomes an audit aid. An ISO 42001 auditor looking at A.6.2.4 will ask how you verify the system; a security answer built on ISO 27090 (robustness testing, a prompt injection test library, red teaming) is a far stronger response than a generic test plan.

Who owns what when you run ISO 27090 vs ISO 42001 side by side

Ownership needs settling early, or controls drift between teams. A workable split:

• The AI governance lead owns the ISO 42001 management system: the AI policy, the impact assessment, the Statement of Applicability and the decision on which AI uses are acceptable.
• The security lead owns the ISO 27090 control set: threat models, per-threat standards, testing, detection and incident response for AI systems.
• Each AI system owner is accountable for applying both to one system, and for recording where a recommendation does not apply and why.
• The ISMS manager keeps one risk register and one risk method across all three.

Which to start with

When the choice is ISO 27090 vs ISO 42001 first, the order depends on what you are being asked for.

• A customer or tender asks for AI governance certification: start with ISO 42001, and use ISO 27090 to fill its security controls with substance.
• A customer’s security questionnaire asks about prompt injection, data poisoning or model theft: start with ISO 27090. Those questions are its subject matter.
• You already hold ISO 27001 and use AI: start with ISO 27090 inside your ISMS; it is the smallest step that addresses AI-specific threats.
• You build high-risk AI under the EU AI Act: you need both. Article 15 requires resilience against the attack classes ISO 27090 covers, while the Act’s governance obligations sit closer to ISO 42001. Our EU AI Act Article 15 guide covers the security side.

If you are also comparing ISO 42001 with the NIST AI Risk Management Framework, our ISO 42001 vs NIST AI RMF guide covers that choice.

Common misconceptions about ISO 27090 vs ISO 42001

Does ISO 27090 replace the security controls in ISO 42001?

No. It explains the threats those controls need to address and how to address them. The ISO 42001 controls remain the ones you are audited against.

Can I get certified to ISO 27090 instead of ISO 42001?

No. ISO 27090 has no certification scheme. If you need a certificate, it has to be ISO 42001 or ISO 27001.

Is ISO 27090 only relevant if we train our own models?

No. Many of its threats apply to systems built on hosted models: prompt injection, unsafe output handling, sensitive output, agent privileges and data leakage among them.

Do the two standards use the same AI life cycle?

Both draw on the ISO/IEC AI vocabulary, so the stages line up. ISO 27090 applies its threats across the life-cycle stages of ISO/IEC 22989, from inception to retirement.

Getting both right

The useful way to think about ISO 27090 vs ISO 42001 is depth and breadth. ISO 42001 gives you the management system and the certificate; ISO 27090 gives the security team the threat model and controls that make the certificate mean something.

Our ISO 42001 Toolkit covers the management system. Our ISO 27090 Toolkit covers the security side: 61 editable documents and workbooks, including a governance charter that sets out exactly how ISO 27001, ISO 42001 and ISO 27090 divide the work, and a crosswalk from every ISO 27090 recommendation to ISO 42001 Annex A. For the official overview of the security standard, see ISO’s ISO/IEC 27090 explained.

Start with whichever one your customers are asking about, and plan for the other. The ISO 27090 Toolkit is built to sit inside either.