ISO 42001 Implementation for Companies With ISO 27001

In this article

1. What Does ISO 42001 Implementation Involve When You Already Have ISO 27001?
2. What you can reuse
3. What you must build
4. Why the order matters
5. How Do You Run an ISO 42001 Implementation Step by Step?
6. Phase 1: Set up the project and the scope
7. Phase 2: Build policy and governance
8. Phase 3: Assess AI risk and impact
9. Phase 4: Implement the controls
10. Phase 5: Train people and keep records
11. Phase 6: Audit and review
12. Phase 7: Certification audit
13. Who Should Own Each Part of ISO 42001 Implementation?
14. What Evidence Should ISO 42001 Implementation Produce?
15. What Does ISO 42001 Implementation Not Cover Under the EU AI Act?
16. Classification and roles
17. Article 15
18. Quality management and EN 18286
19. AI literacy
20. Which Mistakes Slow Down ISO 42001 Implementation?
21. How Does AnnexOps Help With ISO 42001 Implementation?
22. Ready to plan your ISO 42001 implementation?
23. Author: Nitin Grover

ISO 42001 implementation for a company that already holds ISO 27001 means extending its existing management system to address AI-specific requirements. The process can be organised into phases covering scope and roles, policy and governance, risk and impact assessment, controls, competence, internal audit, management review and certification. Both standards share ISO’s harmonised management-system structure, allowing organisations to reuse suitable processes while addressing the requirements specific to AI.

This guide provides an ISO 42001 implementation plan with practical phases, owners and evidence. For the bigger picture, read our guide to integrating ISO 27001 and ISO 42001. To identify your starting point, run the ISO 42001 gap analysis checklist first.

What Does ISO 42001 Implementation Involve When You Already Have ISO 27001?

What you can reuse

ISO/IEC 27001:2022 and ISO/IEC 42001:2023 share ISO’s harmonised management-system structure. Both include clauses covering organisational context, leadership, planning, support, operation, performance evaluation and improvement.

This common structure can help organisations reuse suitable processes, including document control, internal audits, management reviews and corrective actions. Existing processes should still be reviewed to confirm that they adequately address AI-related requirements.

What you must build

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an artificial intelligence management system (AIMS).

Your implementation should address AI-specific responsibilities, AI system impact assessments, measurable AI objectives and the selection and implementation of relevant Annex A controls. ISO/IEC 42001 contains 38 Annex A reference controls organised into nine control objectives. These controls provide a reference for selecting appropriate measures; organisations should document their selection and justification rather than assume that every control must be implemented identically in every context.

Use your copy of the standard to verify the detailed requirements and their applicability to your organisation.

Why the order matters

ISO/IEC 42001 is a voluntary management-system standard. Implementing it or obtaining certification does not, by itself, establish compliance with the EU AI Act. Organisations must assess their applicable legal obligations separately and determine how their AIMS supports those obligations.

How Do You Run an ISO 42001 Implementation Step by Step?

The following seven phases are a practical implementation approach recommended by AnnexOps. ISO/IEC 42001 specifies management-system requirements rather than prescribing this exact project sequence.

Phase 1: Set up the project and the scope

Appoint a project sponsor and an owner for the ISO 42001 implementation. Determine which AI systems, services and organisational activities fall within the AIMS scope. Record the organisation’s role in relation to each AI system and identify the relevant internal and external issues.

Some ISO 27001 holders may find that their initial AIMS scope is narrower than their information security management system (ISMS) scope. The scope should reflect the organisation’s actual activities and intended management-system boundaries.

Phase 2: Build policy and governance

Establish an AI policy, assign responsibilities and determine what top management needs to review. Where suitable, use existing ISMS governance forums rather than creating a separate governance structure.

Define who approves AI-related decisions, who manages risks and impacts, and how significant issues are escalated. Document these responsibilities so that teams understand their roles throughout the AI system life cycle.

Phase 3: Assess AI risk and impact

Extend your existing risk assessment method to address AI-specific risks. Annex C of ISO/IEC 42001 provides examples of potential AI-related risk sources, including bias, explainability and data quality.

Conduct AI system impact assessments that consider potential consequences for individuals, groups and society, as relevant to the system’s context. Clause 6.1.4 addresses AI system impact assessment, while Annex A objective A.5 concerns assessing the impacts of AI systems.

Set measurable AI objectives and document the rationale for selecting applicable Annex A controls. Your existing ISO 27001 processes may provide a useful foundation, but AI risks and impacts require their own assessment.

Phase 4: Implement the controls

Review the nine Annex A control objectives:

1. Policies related to AI
2. Internal organisation
3. Resources for AI systems
4. Assessing impacts of AI systems
5. AI system life cycle
6. Data for AI systems
7. Information for interested parties
8. Use of AI systems
9. Third-party and customer relationships

Select and implement controls based on the organisation’s circumstances, risks and documented decisions. AnnexOps recommends prioritising impact assessment and life-cycle controls where appropriate, because these activities can inform subsequent control decisions.

Phase 5: Train people and keep records

Determine the competence and awareness needs of people involved in developing, providing, deploying or using AI systems, as relevant to their responsibilities.

Maintain documented information under your existing document-control process. Keep records of relevant training, assigned responsibilities, assessments, approvals and decisions so that the AIMS can be evaluated and improved.

Phase 6: Audit and review

Conduct an internal audit that covers the AIMS and its AI-specific requirements. Include AI governance, risk and impact assessments, control implementation, documented evidence and relevant operational processes.

Management review should evaluate the suitability, adequacy and effectiveness of the AIMS. Record findings, decisions and corrective actions, and track them through to completion.

Phase 7: Certification audit

If your organisation chooses certification, engage a certification body to establish the applicable audit arrangements.

Certification audits commonly involve Stage 1, which evaluates readiness and management-system documentation, and Stage 2, which evaluates implementation and effectiveness. The precise audit arrangements depend on the certification body and applicable certification requirements.

Confirm the process with your chosen certification body. Implementation time varies with the scope, number of AI systems, existing processes and resources available. There is no single authoritative timeline that applies to every organisation.

Who Should Own Each Part of ISO 42001 Implementation?

ISO/IEC 42001 does not prescribe the specific job titles in this table. The following allocation is an AnnexOps recommendation that organisations can adapt to their structure.

Role	Responsibility in the ISO 42001 implementation
Top management	Sponsor the programme, approve the AI policy and participate in management review
AI governance lead	Coordinate the AIMS, implementation plan and gap list
ISMS owner	Identify reusable processes and align audits and evidence
Product and ML owners	Provide AI system details, life-cycle information and data records
Legal and data protection	Advise on EU AI Act roles, applicable obligations and data protection requirements
Procurement	Extend supplier assessments to relevant third-party AI systems and services

What Evidence Should ISO 42001 Implementation Produce?

The exact documented information will depend on your organisation’s scope, processes and applicable requirements. This table provides practical examples of evidence to maintain.

Phase	Main output	Evidence to keep
1. Scope	AIMS scope and role records for AI systems	Scope statement and documented role assessments
2. Governance	AI policy and assigned responsibilities	Approved policy and responsibility records
3. Risk and impact	Impact assessments, objectives and control selection	Assessments, objectives and control-selection rationale
4. Controls	Implemented controls	Life-cycle, data-management and supplier records
5. People	Competence and awareness activities	Relevant training and competence records
6. Audit and review	Audit results and management review	Audit reports, review minutes, findings and corrective actions

What Does ISO 42001 Implementation Not Cover Under the EU AI Act?

Plan the following checks alongside ISO 42001 implementation rather than treating certification as a substitute for legal assessment.

Classification and roles

Conduct an EU AI Act assessment for each relevant AI system. Determine whether the system falls within the Act’s scope, whether it qualifies as high-risk under the applicable rules and which obligations apply to your organisation.

An AI risk classification tool or EU AI Act Compliance Checker can support an initial screening, but the outcome should be validated against the legislation and the facts of the particular system.

The legal roles of provider and deployer under the EU AI Act are distinct from responsibilities assigned within an ISO 42001 management system. An organisation’s role must be assessed under the relevant legal definitions and circumstances.

Article 15

Article 15 establishes requirements for high-risk AI systems concerning accuracy, robustness and cybersecurity. The applicable compliance dates depend on the relevant category of high-risk AI system and the EU AI Act’s transitional provisions.

For the relevant dates, see our Annex III deadline guide. Organisations should confirm which provisions and deadlines apply to their systems rather than assume that every high-risk AI system follows the same timetable.

Quality management and EN 18286

Commission Implementing Decision (EU) 2026/2274, published in the Official Journal on 14 October 2026, cites EN 18286:2026 as a harmonised standard supporting the EU AI Act’s quality management requirements.

Under the applicable conformity framework, applying a cited harmonised standard can provide a presumption of conformity for the legal requirements it covers. EN 18286:2026 addresses quality management for EU AI Act regulatory purposes. Its presumption of conformity is limited to the relevant requirements identified in the standard, including the covered provisions concerning Article 17(1) and the first sentence of Article 11(1), subject to the standard’s scope and conditions.

Certification to ISO/IEC 42001 alone does not establish a presumption of conformity with the EU AI Act. An ISO 42001 implementation can provide a useful foundation for AI governance and management processes, but it does not replace the assessment of the requirements covered by EN 18286 or other applicable legal obligations.

For more context, read what a certificate does and does not cover.

AI literacy

Article 4 of the EU AI Act has applied since 2 February 2025. It requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and other persons dealing with the operation and use of AI systems on their behalf, taking account of their technical knowledge, experience, education, training, the context in which the AI systems are used and the persons or groups on whom they are to be used.

The Act does not require a specific AI literacy certificate. Organisations can maintain internal records of training and other literacy initiatives as evidence of their measures. The appropriate approach depends on the organisation’s context and the people involved.

Read our guide to AI literacy training under Article 4.

Which Mistakes Slow Down ISO 42001 Implementation?

Starting with controls. Selecting controls before assessing AI risks and impacts can lead to rework. Establish the assessment process first, then use its results to inform control selection.

Scoping only the model. AI governance may also involve data, third-party suppliers, deployment environments and users. Consider these elements when defining the AIMS scope and assessing risks.

Treating it as a one-off project. ISO/IEC 42001 requires continual improvement. Assign ongoing ownership of the AIMS after certification and maintain processes for monitoring performance, reviewing changes and addressing findings.

Maintaining separate evidence for every audit. Where appropriate, maintain a controlled record once and link it to the different requirements it supports. Check that the record remains current and adequate for each purpose.

How Does AnnexOps Help With ISO 42001 Implementation?

ISO 42001 implementation generates records covering AI inventories, assessments, responsibilities, controls and management reviews. AI compliance software can help teams link these records to the relevant AI systems and governance activities.

The AnnexOps ISO 42001 page describes the platform’s mapping of ISO/IEC 42001 to 65 requirements, covering clauses 4 to 10 and the 38 Annex A controls. Confirm the current mapping and counting methodology against the live product before relying on this figure.

Coverage can draw on AI inventories, model cards, human oversight designs and AI literacy records maintained for EU AI Act governance. The ISO 27001 page describes how AnnexOps supports ISMS-related controls, risks and evidence management.

For the ISO 42001 implementation plan above, this can mean:

• Phase 1 and Phase 3 inputs can come from an existing AI inventory and classification records, where available.
• Phase 5 training records can be managed through the AI Literacy & Training Tracker, where this functionality is available in the product.
• Evidence for Phases 6 and 7 can be stored in the Evidence Vault, with approvals and audit trails, where supported by the configured workflow.

AnnexOps positions its software as an EU AI Act compliance platform and an AI-based continuous monitoring platform. Its suitability depends on the functionality available and how the organisation configures and uses it. AnnexOps supports compliance operations; it does not issue ISO certificates, replace a certification body or provide a substitute for legal advice.

Author: Nitin Grover

Nitin Grover is an AI compliance strategist and writer focused on EU AI Act compliance, AI governance, Annex IV documentation, AI risk management, and AI compliance operations for AI startups, SaaS companies, and enterprise AI teams across Europe.