The short answer
ISO 27001 is the standard for protecting information. ISO 42001 is the standard for governing artificial intelligence responsibly. They are complementary, not competing: both use the same management-system structure, so an organisation with an ISO 27001 ISMS already has much of the foundation an ISO 42001 AI Management System (AIMS) needs. The difference is what each manages — ISO 27001 manages risks to the confidentiality, integrity and availability of information, while ISO 42001 manages the wider risks and impacts of AI on people, organisations and society, such as bias, lack of transparency and misuse.
If your business handles sensitive data, start with ISO 27001. If you build, sell or depend on AI — and your customers are asking how you govern it — add ISO 42001, ideally as one integrated management system.
ISO 42001 vs ISO 27001 at a glance
| ISO/IEC 27001:2022 | ISO/IEC 42001:2023 | |
|---|---|---|
| Manages | Information security (ISMS) | Artificial intelligence (AIMS) |
| Core question | Is our information protected? | Is our AI governed responsibly? |
| Risk focus | Confidentiality, integrity and availability of information | AI risks and impacts: fairness, transparency, safety, security, privacy, accountability |
| Impact assessment | Not required as a separate step | AI system impact assessment is required (clause 6, Annex A.5) |
| Annex A controls | 93 controls in 4 themes: organisational, people, physical, technological | 38 controls in 9 objectives: AI policy, organisation, resources, impacts, life cycle, data, transparency, use, third parties |
| Structure | Harmonised structure, clauses 4–10 | Same harmonised structure, clauses 4–10 |
| Statement of Applicability | Required | Required |
| Life-cycle focus | Information assets and processes | The full AI system life cycle, from design to retirement |
| Typical drivers | Client contracts, data protection, NIS 2, cyber risk | Customer AI due diligence, EU AI Act readiness, responsible-AI commitments |
| Certifiable | Yes | Yes |
Where ISO 42001 and ISO 27001 overlap
Because both standards share the harmonised structure, these elements can usually be reused or extended rather than rebuilt:
- Context, scope and interested-party analysis (clause 4)
- Leadership commitment, policy framework and roles (clause 5)
- Risk assessment and treatment methodology (clause 6)
- Competence, awareness, communication and document control (clause 7)
- Internal audit, management review and corrective action (clauses 9–10)
- Supplier management, access control, logging and incident management controls
In practice, many organisations find a large share of their ISMS processes can be extended to cover AI.
What ISO 42001 adds
- AI system impact assessment: evaluating effects on individuals, groups and society — not just on the organisation.
- AI life-cycle controls: requirements for responsible design, development, verification, deployment, monitoring and retirement of AI systems.
- Data for AI: data quality, provenance and preparation for training and operating models.
- Transparency and human oversight: information for users and affected people, and defined human control over AI decisions.
- Responsible use: making sure AI is used for its intended purpose, including generative AI tools used by staff.
- Role clarity: whether you are an AI provider, developer or user changes which controls apply.
How to extend your ISO 27001 ISMS into an AIMS
- Add AI to the scope — inventory the AI systems you build, provide or use, including SaaS and generative AI tools.
- Extend the risk method to AI risk sources such as bias, model drift, explainability and misuse, and add AI system impact assessments.
- Write an AI policy that links to your information security policy.
- Map the 38 Annex A controls against your existing ISO 27001 controls; implement the gaps.
- Update the Statement of Applicability, training and awareness for AI.
- Combine internal audits and management reviews so one programme covers both standards.
- Ask your certification body about an integrated audit — many can certify both standards together.
Which should you do first?
| Your situation | Recommended path |
|---|---|
| No certification yet, handling client or personal data | ISO 27001 first, then add ISO 42001 |
| Already ISO 27001 certified and using or selling AI | Extend to ISO 42001 now |
| AI product company facing customer AI due diligence | ISO 42001, with ISO 27001 security controls alongside |
| Preparing for the EU AI Act's high-risk obligations | ISO 42001 to organise governance, plus legal review of the Act's specific duties |
Frequently asked questions
Is ISO 42001 a replacement for ISO 27001?
No. ISO 27001 covers information security; ISO 42001 covers AI governance. Most organisations that use AI seriously will benefit from both.
Do I need ISO 27001 before ISO 42001?
No, ISO 42001 can be certified on its own. But an existing ISO 27001 ISMS makes ISO 42001 faster to implement because the management-system processes already exist.
Can one audit cover both ISO 27001 and ISO 42001?
Many certification bodies offer integrated audits for organisations running a combined management system. Check that the body is accredited for both standards.
How many controls do ISO 27001 and ISO 42001 have?
ISO 27001:2022 has 93 Annex A controls in 4 themes. ISO 42001:2023 has 38 Annex A controls under 9 control objectives.
Which course should I take first?
If you already know ISO 27001, go straight to ISO 42001 Lead Implementer. If you are new to management systems, ISO 27001 Lead Implementer gives the foundation that ISO 42001 builds on.
Build both skills with WiseLearner
WiseLearner offers ISO 42001 Lead Implementer, ISO 42001 Lead Auditor, ISO 27001 Lead Implementer and ISO 27001 Lead Auditor training live online and for corporate teams. Read our complete guide to ISO 42001 certification, or call +91 99084 55513 for the next batch dates.
