ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
If you already hold ISO 27001, you can integrate ISO 42001 with ISO 27001 instead of building a second system from scratch. Both standards share the same management system skeleton, so a large part of the work is already done.
The risk is treating integration as a copy and paste job. AI adds requirements that information security does not cover, such as impact assessment, AI system life cycle controls and data quality for AI.
This guide shows what to reuse, what to add and how to run a joint audit. For a side-by-side comparison of the two standards, read our ISO 27001 vs ISO 42001 guide.
Free gap assessment
How much of ISO 42001 could you evidence today?
Score every clause and Annex A control of the AI management standard, free, and see where the programme really sits.
Run the free ISO 42001 gap assessment → or View premium report sample
ISO 27001 and ISO 42001 follow the same harmonised high-level structure for management system standards. Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement in both.
That means many processes serve both standards: document control, internal audit, management review, corrective action, competence and communication.
You do not need two audit programmes or two management reviews. One system with both scopes is more efficient and easier for staff to follow.
The ISO 27001 standard page is ISO/IEC 27001 on iso.org.
Reuse the document control procedure, internal audit programme, corrective action process and management review structure. Extend each to name the AI management system in its scope.
Reuse supporting processes too: training and awareness, supplier management, incident management and change control, adding AI-specific content where needed.
The ISO 27001 policy framework can host a new AI policy. Keep the AI policy as its own document, linked to the information security policy, because each has a distinct purpose.
When you integrate ISO 42001 with ISO 27001, update each shared procedure once, then record the change in your document register so the audit trail is clean.
Four areas need new work. First, an AI risk assessment that covers harms to people and society, not just confidentiality, integrity and availability. See our AI risk assessment guide.
Free AI risk assessment
Which of your AI systems could harm people, or you?
List your AI systems, models and data, pick from 38 AI risk scenarios, rate them for the people affected and for you, and plan treatment with ISO 42001 Annex A controls. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free AI risk assessment → or View premium report sample
Second, an AI system impact assessment under clause 6.1.4. Third, the Annex A controls for AI: policy, roles, resources, impact assessment, system life cycle, data, information for interested parties, use and third-party relationships. Fourth, AI objectives and monitoring.
Do not assume your ISO 27001 risk process is enough. It lacks the impact lens that ISO 42001 requires.
A ready-made ISO 42001 Toolkit gives you the AI-specific documents to add to your existing system.
Treat the impact assessment as the key new element. It is where many teams spend most of the additional effort.
Aligning the scope is the easiest route when the AI systems sit inside the same boundary as your information security management system. One scope statement can name both standards.
If AI work sits in a different business unit, keep two scopes but share governance. Make sure the boundaries are clear to the certifier. Our ISO 42001 scope guide helps you word it.
Whichever approach you choose, record why. The reasoning matters more than the choice.
Whatever you choose, tell your certifier early so audit planning matches your structure.
Extend your risk register with AI risks, and mark each risk as security, AI or both. Many risks overlap: a model theft is a security and an AI risk, while a biased output is mainly an AI risk.
Use one methodology with a consistent scale, but add AI-specific criteria such as impact on individuals and groups. This keeps reporting simple for management.
Update the treatment plan and link it to both Statements of Applicability, so each control is justified once and applied in the right place.
Train the risk team on the AI harms catalogue before the first combined assessment, so the scoring is consistent between reviewers.
You can keep two separate statements or combine them into one document with two sections. Two statements are cleaner for audit trails, while a combined statement saves maintenance.
ISO 27001:2022 has 93 Annex A controls, while ISO 42001 has 38. Some overlap, such as supplier management, data protection and incident handling. Map the overlaps so one control implementation supports both statements.
See our Statement of Applicability guide for the structure.
Many certification bodies can audit both standards together if they are accredited for both. A joint audit reduces duplicated interviews and document review, which can lower audit time and cost.
Ask your certifier how it handles integrated audits and how audit days are calculated. Confirm the ISO 42001 accreditation scope before you plan the joint audit.
Our guide to the ISO 42001 certification body explains how to check this.
Share the audit plan with both teams in advance, so interviews are scheduled once and nobody is called away mid-project.
| Element | ISO 27001 | ISO 42001 | Integration approach |
|---|---|---|---|
| Clauses 4-10 | Management system | Management system | Share processes |
| Risk assessment | Information security risk | AI risk plus impact assessment | Extend one method |
| Annex A | 93 controls | 38 controls | Map overlaps |
| Policy | Information security policy | AI policy | Separate documents, linked |
| Audit | ISMS audit | AIMS audit | Joint audit where accredited |
Run one internal audit programme covering both standards. Use auditors who understand both, and add AI-specific checks to the audit checklist.
Add AI inputs to the management review: AI incidents, impact assessment results, objectives progress and supplier performance. See our management review guide.
One review with clearly separated sections gives leaders a single view of risk and keeps the effort manageable.
Phase one: confirm scope, inventory AI systems and run a gap analysis against ISO 42001. Phase two: update shared processes and draft the AI-specific documents.
Phase three: run the AI risk and impact assessments, select controls and write the Statement of Applicability. Phase four: internal audit, management review and certification audit.
Our gap analysis guide describes the first phase in detail. Existing ISO 27001 teams often finish phases one and two quickly.
Plan to integrate ISO 42001 with ISO 27001 as one project with one owner.
Common mistakes are folding AI into the information security policy so nothing AI-specific is visible, forgetting to train AI teams on the combined system and ignoring non-security harms in the risk method.
Another is assuming the same people can run both without extra time. AI governance needs technical and ethical input beyond the security team.
Finally, avoid duplicating records. A single risk register and a single corrective action log are easier to keep accurate.
Teams that integrate ISO 42001 with ISO 27001 carefully avoid the duplication that slows audits.
An integrated system gives one set of processes, one audit cycle and one management view. Staff learn one way of working, and auditors see a consistent system.
It also improves credibility with customers who ask about both security and AI. A joint certificate set answers two common questionnaires.
Savings depend on how mature your ISO 27001 system is. Treat any estimate as a range, and measure the real effort during your project.
Review the arrangement after the first full audit cycle and adjust where the combined system created friction.
Keep clear accountability. A single executive sponsor can own both standards, while the information security lead and the AI governance lead each own their domain.
Set up a joint steering group that meets regularly. It reviews risks, incidents, audit results and objectives across both areas, and escalates decisions to top management.
Define how the two leads cooperate on shared topics such as data protection, supplier assessment and incident response. Overlap without clear ownership leads to gaps, and gaps lead to audit findings.
Write the arrangement down in your roles document, and make sure both teams know who decides what.
Choose tools that serve both standards: one document repository, one risk register, one corrective action log and one training tracker, each with fields for AI items.
Avoid building a parallel set of spreadsheets for AI. Parallel records drift apart, and a certifier will notice when two registers disagree.
If you use a governance, risk and compliance platform, add the ISO 42001 clauses and controls as a new framework mapped to existing controls. That is the fastest way to integrate ISO 42001 with ISO 27001 in practice.
Keep access controls consistent too. AI records may include sensitive data about models and datasets, so apply the same protection as other critical information.
No. ISO 42001 can be implemented alone, but an existing ISO 27001 system gives you many of the processes ready to use.
Yes, if the auditors are competent in both and the audit plan covers the requirements of each.
It can reduce duplicated effort. Confirm audit time and pricing with your certification body.
One meeting can cover both, as long as inputs and decisions for each standard are recorded clearly.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026