ISO 27001 ↔ ISO 42001 — Connecting Information Security and AI Management

Shared Structure — High-Level Structure

All ISO management system standards (27001, 9001, 14001, 42001) are built on the same 10-clause skeleton. Across every one of those clauses, the management requirements are 95% identical between ISO 27001 and ISO 42001.

A single document describing the organizational structure, one list of role holders, one internal audit procedure — all serve both standards simultaneously.

Annex A Mapping — Overlap and Differences

Direct Overlap (~60% of ISO 42001 controls are already covered by ISO 27001)

An organization with an active ISO 27001 ISMS can extend existing controls to cover ISO 42001 — for example, the "Inventory of information assets" document becomes an "Inventory of information + AI assets" with additional fields (model type, vendor, risk level).

Unique to ISO 42001 (~40% of controls are new)

• A.6.2.2 — Documentation of AI systems — Detailed technical documentation for every AI system: model architecture, training data, performance metrics.
• A.6.2.3 — Tools for ML lifecycle — Model version control, experiment management, model registry.
• A.7.4 — Transparency to users — When a user interacts with an AI system, they must be informed of that fact. Unique to AIMS.
• A.9 — Responsible use of AI — Permitted and prohibited use policy, including scenarios where AI is not appropriate.
• A.7.5 — Human oversight — Human supervision over systems that make decisions with personal impact. Also a point of intersection with the EU AI Act and with Amendment 13.

Combined Work Plan — 6 Months

An organization already implementing ISO 27001 that plans to add ISO 42001 can follow this sequence:

1. Month 1 — Gap analysis: Compare the existing ISMS against ISO 42001 requirements. Output: a prioritized list of gaps. (See AI Risk Assessment.)
2. Months 1–2 — AI asset mapping: Register all AI systems in the organization.
3. Month 2 — Policy update: Add an AI Use Policy to existing policies.
4. Month 3 — New controls: Implement the controls unique to ISO 42001.
5. Month 4 — Contracts: Update Data Processing Agreements with AI vendors.
6. Month 5 — Combined internal audit: Test the implementation of both standards together.
7. Month 6 — Gap remediation + certification audit: External combined audit.

Business Benefits of the Combined Approach

• Cost savings — One audit instead of two, one consultant familiar with both standards, fewer management days.
• Simpler documentation — One set of core procedures, not two sets that need to be kept in sync.
• Strong business signal — Two certifications simultaneously: an organization that "takes both information security and AI seriously." Important in tenders and negotiations with US and European customers.
• Regulatory infrastructure — Together, both standards cover approximately 80% of the requirements under Amendment 13, the EU AI Act, and the GDPR.