ISO 27001 and ISO 42001: How to Integrate Both Standards

In this article

1. What Do ISO 27001 and ISO 42001 Each Cover?
2. ISO/IEC 27001:2022 covers information security
3. ISO/IEC 42001:2023 covers AI management
4. Neither one is law
5. Why Can ISO 27001 and ISO 42001 Be Integrated?
6. One shared structure
7. What you can share and what you must add
8. Controls are similar, not identical
9. How Do You Integrate ISO 27001 and ISO 42001 Step by Step?
10. 1. Start from one inventory
11. 2. Set the AI scope on top of the ISMS scope
12. 3. Extend the risk method
13. 4. Reuse governance
14. 5. Map controls by objective
15. 6. Keep one evidence library
16. Which Standard Should You Start With?
17. What Does the EU AI Act Add to ISO 27001 and ISO 42001?
18. Neither standard gives a presumption of conformity
19. But ISO 42001 is a useful base
20. ISO 27001 does not replace Article 15
21. What each instrument does for you
22. Where Does AI Compliance Software Fit?
23. What Mistakes Do Teams Make When They Integrate ISO 27001 and ISO 42001?
24. Treating the ISO 42001 certificate as EU AI Act compliance
25. Two risk registers
26. Scoping only the model
27. One evidence folder per audit
28. Related Reading
29. Ready to coordinate ISO 27001 and ISO 42001 in one workflow?
30. Author: Nitin Grover

ISO 27001 and ISO 42001 can be integrated into a single management system because they use the same harmonised structure for clauses 4 to 10. Organisations can coordinate shared processes such as document control, internal audits, management reviews, and corrective action. However, the standards have different objectives and requirements: ISO 27001 focuses on information security management, while ISO 42001 focuses on managing AI-related risks and opportunities across the organisation.

ISO itself offers the two standards together as an AI and information security management package. Integrating them does not, by itself, establish compliance with the EU AI Act or other applicable European and German legal requirements. This guide explains how to coordinate both management systems and where regulatory obligations must be assessed separately. For the legal comparison, see our ISO 42001 vs EU AI Act guide.

This guide covers how to integrate ISO 27001 and ISO 42001 from start to finish. For deeper detail on specific areas, see:

• ISO 27001 vs ISO 42001: What Is the Difference? 
• ISO 27001 to ISO 42001: Gap Analysis Checklist 
• ISO 42001 Implementation for Companies With ISO 27001
• ISO 42001 vs EU AI Act: What a Certificate Does and Does Not Cover
• One Evidence Library for Both ISO 27001 and ISO 42001 Audits

What Do ISO 27001 and ISO 42001 Each Cover?

For a side-by-side view of the two standards, read ISO 27001 vs ISO 42001: what is the difference.

ISO/IEC 27001:2022 covers information security

ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). It provides a systematic approach to managing information security risks and protecting information’s confidentiality, integrity and availability. Organisations define the ISMS scope and select controls based on their risks and applicable requirements.

ISO/IEC 42001:2023 covers AI management

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS). Published in December 2023, it is the first international management system standard dedicated to AI. It provides an organisational framework for managing AI-related risks and opportunities; the exact processes and controls an organisation needs depend on its context and the standard’s requirements. KPMG’s summary discusses topics including risk management, impact assessment, lifecycle management and supplier oversight.

Neither one is law

ISO 27001 and ISO 42001 are voluntary standards unless a separate contract, procurement condition or legal requirement makes their use relevant to a particular organisation. ISO/IEC 42001 is a voluntary standard, not an EU regulation. Certification indicates that a management system has been assessed against the relevant standard within the certificate’s scope. It does not, by itself, demonstrate compliance with every applicable law or regulation.

Why Can ISO 27001 and ISO 42001 Be Integrated?

One shared structure

ISO management system standards use a common harmonised structure defined through the ISO/IEC Directives. This structure aligns the main clauses on organisational context, leadership, planning, support, operation, performance evaluation and improvement. ISO/IEC 27001:2022 was one of the first standards adapted to it, and ISO/IEC 42001:2023 uses the same main clause layout.

This shared structure makes it possible to coordinate processes such as document control, internal audits, management reviews and corrective action. It does not mean that the two standards’ individual requirements or evidence needs are interchangeable.

What you can share and what you must add

The table summarises processes that may be coordinated across the two standards and AI-specific topics that an organisation should address through its AIMS. Treat it as an integration aid, not as a substitute for reviewing the full requirements of either standard.

Clause	Share across ISO 27001 and ISO 42001	Add for AI
4 Context	Interested parties, legal and customer requirements	AI-specific scope and context
5 Leadership	Policy structure, roles, top management reporting	AI policy and AI accountability
6 Planning	Risk method, objectives process	AI risk and impact assessment
7 Support	Competence, awareness, document control	AI skills and AI documentation
8 Operation	Change and supplier processes	AI lifecycle and third-party AI controls
9 Performance evaluation	Internal audit, management review	AI performance and audit criteria
10 Improvement	Corrective action process	AI incident and nonconformity handling

Controls are similar, not identical

ISO 27001 and ISO 42001 have separate requirements and Annex A control frameworks. Some controls may support more than one objective, but they should not be treated as equivalent simply because their titles look similar. Map by objective, not by control number, and validate each mapping against the applicable editions of both standards and your organisation’s scope. Avoid relying on generic overlap percentages unless the methodology and source are clear.

How Do You Integrate ISO 27001 and ISO 42001 Step by Step?

The sequence below is our recommendation, not a requirement of either standard.

1. Start from one inventory

Create an inventory of AI systems, relevant models, data flows, suppliers and supporting information assets. It can provide a shared starting point for defining the ISMS and AIMS scopes and for assessing which EU AI Act obligations may apply. An inventory alone does not determine an AI system’s legal classification.

2. Set the AI scope on top of the ISMS scope

Define which organisational activities, AI systems and relevant external providers fall within the AIMS. The AIMS and ISMS scopes may overlap without being identical; document the rationale, interfaces and exclusions for each scope.

3. Extend the risk method

Coordinate the risk assessment methods where practical, while preserving the distinct criteria required by each standard. ISO/IEC 27001:2022 clause 6.1.3 includes the selection of information security risk treatment options, determination of necessary controls, comparison with Annex A and preparation of a Statement of Applicability. Add AI-specific risks and impacts on individuals, groups or society through the AIMS process rather than assuming the ISMS assessment covers them automatically.

4. Reuse governance

Where appropriate, use coordinated policies, clearly assigned responsibilities, an integrated internal audit programme and a combined management review. Ensure that each standard’s required inputs, criteria, decisions and records are covered; a single meeting or document must not omit standard-specific requirements.

5. Map controls by objective

Build a control map with three columns: the ISO 27001 objective, the ISO 42001 objective and the evidence that serves both.

6. Keep one evidence library

Both audits may rely on evidence such as approvals, reviews, logs and records, although the required evidence depends on the applicable clause, control and audit scope. Store each item once where appropriate, maintain its ownership and version history, and map it to each requirement it genuinely supports.

Which Standard Should You Start With?

The right starting point depends on your existing management systems, customer expectations, risk profile and resources. If you already hold ISO 27001, extend it by assessing the additional AIMS requirements and AI-specific risks; an existing ISMS can provide useful governance processes but does not automatically satisfy ISO 42001. If you hold neither, prioritise based on business needs and the risks you need to manage. ISO 27001 certification is not stated as a prerequisite for implementing ISO 42001; confirm certification arrangements with your chosen certification body.

What Does the EU AI Act Add to ISO 27001 and ISO 42001?

Neither standard gives a presumption of conformity

Article 40 of the EU AI Act provides for a presumption of conformity with the requirements covered by a harmonised standard whose reference has been published in the Official Journal of the European Union, subject to the conditions and scope of the Act. CEN-CENELEC JTC 21 reports that Commission Implementing Decision (EU) 2026/2274 cited EN 18286:2026 on 14 October 2026. Check the published reference and decision for the standard’s precise scope before relying on that presumption.

EN 18286:2026 addresses the quality management system requirements in Article 17 for providers of high-risk AI systems. Applying a harmonised standard is generally voluntary, but using it may provide a presumption of conformity for the specific requirements it covers, where the legal conditions are met. ISO/IEC 42001:2023 is not, by itself, a cited harmonised standard under Article 40; certification to ISO 42001 alone therefore does not create that presumption. Our guide to what an ISO 42001 certificate does and does not cover goes deeper.

But ISO 42001 is a useful base

The informative annexes in EN 18286 provide mappings to related management system standards, including EN ISO 9001 and EN ISO/IEC 42001. Organisations with existing certified systems may be able to reuse relevant processes and evidence, but should perform a clause-by-clause gap assessment. Check Annex ZA and the Implementing Decision for the precise scope of any presumption of conformity.

ISO 27001 does not replace Article 15

Article 15 sets requirements for high-risk AI systems concerning appropriate levels of accuracy, robustness and cybersecurity, including resilience against attempts by unauthorised third parties to alter their use or performance by exploiting system vulnerabilities. ISO/IEC 27001 assesses an information security management system; certification alone does not demonstrate that a particular AI system meets every Article 15 requirement. Organisations should assess the system-level technical and organisational measures that apply to their role and system.

Standards work in areas such as cybersecurity continues, so organisations should check for updates rather than assume that the current set of standards is complete. Under the amended application timetable, the relevant high-risk AI system requirements in Chapter III, Sections 1 to 3, apply from 2 December 2027 to systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 to systems classified as high-risk under Article 6(1) and Annex I. Other AI Act obligations have different application dates. See our Annex III deadline guide.

What each instrument does for you

Instrument	Type	Legal effect under the AI Act	What it supports
ISO/IEC 27001:2022	Voluntary standard	No presumption of conformity	Information security management
ISO/IEC 42001:2023	Voluntary standard	No presumption of conformity	AI governance management
EN 18286:2026	Harmonised standard, reference published 14 Oct 2026	Potential presumption for covered Article 17 QMS requirements, subject to legal conditions	Quality management system for high-risk AI providers
Article 15	Binding law	Applies to high-risk providers	Accuracy, robustness, cybersecurity

Where Does AI Compliance Software Fit?

A management system provides governance processes, but it does not automatically determine the legal classification of each AI system. Organisations should assess the system’s intended purpose, context and relevant EU AI Act provisions to determine which rules may apply. An EU AI Act compliance checker or AI risk classification tool can support an initial screening, but its output should be validated against the law and relevant guidance, especially when a system or its intended use changes.

AI compliance software can help teams coordinate an AI inventory, governance records and supporting evidence across ISO 27001, ISO 42001 and relevant EU AI Act obligations. AnnexOps AI Compliance Software supports inventory, risk classification, documentation and evidence management, while its AI Auditor Engine can be used for readiness checks. These tools can support compliance operations, but do not replace a legal assessment, a required conformity assessment, or an accredited certification audit. Product capabilities and monitoring coverage should be confirmed against the current AnnexOps configuration. See how AnnexOps handles ISO 27001 and ISO 42001. AnnexOps supports compliance operations and does not replace legal advice or an accredited audit.

What Mistakes Do Teams Make When They Integrate ISO 27001 and ISO 42001?

Treating the ISO 42001 certificate as EU AI Act compliance

A certificate to ISO 42001 can demonstrate that an AIMS has been assessed against that standard, but it does not establish compliance with the EU AI Act as a whole. Article 40’s presumption of conformity applies only where the relevant harmonised standard has been cited and only to the requirements within its applicable scope.

Two risk registers

Separate risk registers can create duplication or inconsistent ownership. Where practical, use a coordinated register or linked registers with clear categories, owners, assessment criteria and traceability to the requirements of each standard.

Scoping only the model

AI-related risks can arise from data, third-party services, deployment context, human oversight and the way people use a system, not only from the model itself. Define the AIMS scope and risk assessment to reflect the organisation’s actual AI activities and relevant lifecycle stages.

One evidence folder per audit

Recreating evidence for each audit can cause duplication and inconsistent records. Maintain controlled evidence and map it to each applicable requirement it supports, while ensuring the evidence remains sufficient for the specific audit criteria.

Related Reading

• ISO 27001 vs ISO 42001: What Is the Difference?
• ISO 27001 to ISO 42001: Gap Analysis Checklist 
• ISO 42001 Implementation for Companies With ISO 27001
• ISO 42001 vs EU AI Act: What a Certificate Does and Does Not Cover 
• One Evidence Library for Both ISO 27001 and ISO 42001 Audits