ISO 27001 and ISO 42001 address different organisational risks and require distinct governance controls. ISO 27001 is an information security management standard focused on protecting data confidentiality, integrity, and availability. ISO 42001 is an AI management system standard focused on the responsible development and use of artificial intelligence. Organisations subject to both information security obligations and AI-related regulations will typically need both. The sections below unpack each standard’s governance requirements, how they interact, and what implementing them together looks like in practice. If you want to talk through your specific situation, feel free to get in touch with us and we will be happy to help.

Which organisational risks does each standard actually address?

ISO 27001 addresses risks to information assets, including unauthorised access, data breaches, system failures, and insider threats. ISO 42001 addresses risks specific to AI systems, including biased outputs, lack of human oversight, opaque decision-making, and unintended societal harm. The two standards target different threat landscapes, even when both apply to the same organisation.

ISO 27001 takes a broad information security lens. It asks: what could go wrong with our data and systems, and how do we control those risks? This includes everything from access management and encryption to supplier security and incident response. The standard applies to any organisation that handles information of value, which in practice means almost every regulated business today.

ISO 42001, by contrast, focuses specifically on the governance of AI systems. It asks: how do we ensure our AI tools and processes operate responsibly, transparently, and within defined boundaries? This includes questions of AI impact assessment, accountability for algorithmic decisions, and mechanisms for human review. The risks it targets are newer and less familiar to most governance teams, but increasingly relevant as AI adoption accelerates across sectors.

Where the two standards overlap is in the broader concept of organisational risk management. Both require a structured approach to identifying, assessing, and treating risks. But the nature of those risks, and the controls needed to address them, are meaningfully different.

What are the core governance controls in ISO 27001 versus ISO 42001?

ISO 27001 governance controls centre on information security policies, access management, risk treatment, incident management, and supplier oversight. ISO 42001 governance controls focus on AI policy, impact assessments, transparency obligations, human oversight mechanisms, and accountability structures for AI-driven decisions. Both standards use a Plan-Do-Check-Act management system framework, but their control sets reflect their distinct subject matter.

Core controls in ISO 27001

ISO 27001’s Annex A contains a structured set of information security controls covering organisational, people, physical, and technological domains. Key governance-relevant controls include information security policies, defined roles and responsibilities, asset management, access control, cryptography, supplier relationships, and business continuity. The standard requires organisations to select and implement controls based on their risk assessment, and to document their decisions in a Statement of Applicability.

Core controls in ISO 42001

ISO 42001 introduces a new category of controls built around the AI system lifecycle. These include defining the intended purpose and scope of AI use, conducting AI impact assessments before deployment, establishing human oversight procedures, maintaining transparency with affected parties, and setting up processes to monitor AI performance over time. The standard also requires organisations to define their role in the AI supply chain, whether as a developer, deployer, or both, since governance obligations differ depending on that role.

A practical distinction worth noting: ISO 27001 controls are largely defensive and protective, aimed at preventing harm to information. ISO 42001 controls are more proactive and ethical in character, aimed at ensuring AI systems behave as intended and do not cause unintended harm. Both demand continuous governance rather than one-off compliance exercises.

Can an organisation implement ISO 27001 and ISO 42001 together?

Yes, and for many organisations it makes strategic sense to do so. Both standards follow the ISO High Level Structure, which means they share a common management system framework. Organisations that already hold ISO 27001 certification can extend their existing governance infrastructure to cover ISO 42001 requirements, reusing policies, risk management processes, and internal audit functions rather than building a parallel system from scratch.

The shared structure means that elements like leadership commitment, documented information, internal audits, and management review are required by both standards in compatible ways. A governance team that understands how to run an ISO 27001 management system will recognise the same rhythm in ISO 42001. This significantly reduces the overhead of implementing both.

That said, the subject matter diverges considerably. ISO 42001 requires expertise in AI governance that most information security teams do not yet have. Organisations implementing both standards need people who understand not just how to manage a management system, but how AI systems work, what their failure modes look like, and how to assess their societal and operational impacts. This is one of the reasons we see growing demand for integrated governance services that span security, privacy, and AI within a single operational model.

Who is responsible for governance under each standard?

Under both ISO 27001 and ISO 42001, top management holds ultimate accountability for governance. Both standards explicitly require leadership to demonstrate commitment, allocate resources, and take ownership of the management system. In practice, ISO 27001 governance is typically led by an Information Security Officer or equivalent, while ISO 42001 governance often requires a designated AI governance lead or committee with cross-functional representation.

ISO 27001 has a well-established role structure that most organisations are familiar with. The Information Security Officer or CISO owns the management system, supported by risk owners across the business who are accountable for specific assets and processes. The standard is clear that governance cannot be delegated entirely to IT: business functions must own their information security risks.

ISO 42001 introduces a broader accountability question because AI systems often cut across multiple business functions simultaneously. A single AI tool might affect HR decisions, customer interactions, and financial outputs at the same time. Governance under ISO 42001 therefore requires clear ownership not just of the technology, but of the decisions the AI supports or makes. This demands genuine management engagement, not just technical oversight.

In both cases, the standard requires that governance responsibilities are formally assigned, communicated, and reviewed. Role-based accountability is not optional. Organisations that rely on individual knowledge or informal arrangements will struggle to demonstrate conformity during certification audits.

Does ISO 42001 certification replace or complement ISO 27001?

ISO 42001 certification complements ISO 27001 and does not replace it. The two standards govern different domains. ISO 27001 remains the baseline for information security management and is required or expected under frameworks including NIS2, DORA, and many contractual obligations. ISO 42001 addresses a distinct set of governance requirements related to AI that ISO 27001 does not cover. Organisations using AI systems need both.

A useful way to think about this: ISO 27001 secures the environment in which AI operates. ISO 42001 governs how AI itself is developed, deployed, and monitored. An organisation could have excellent information security controls and still deploy AI systems irresponsibly. Equally, strong AI governance does not compensate for weak information security. The two standards address different failure modes.

For organisations operating under EU regulation, this distinction is increasingly important. The EU AI Act introduces binding obligations for high-risk AI systems that align closely with ISO 42001’s scope. Demonstrating ISO 42001 conformity is likely to become a credible way to evidence compliance with those obligations. But it does not touch the information security requirements that NIS2, DORA, and ISO 27001 address. Regulated organisations will need both frameworks operating in parallel as part of a coherent continuous governance programme.

What does the certification process look like for each standard?

Both ISO 27001 and ISO 42001 follow a two-stage certification audit process conducted by an accredited certification body. Stage one reviews documentation and readiness. Stage two is an on-site assessment of whether the management system is effectively implemented. Certification is typically valid for three years, with annual surveillance audits in between. The main difference is maturity: ISO 27001 has a large pool of experienced auditors globally, while ISO 42001 audit capacity is still developing.

For ISO 27001, the certification journey is well-documented and the market is mature. Organisations can draw on established guidance, experienced consultants, and a clear body of audit practice. The process typically takes six to twelve months from initial implementation to certification, depending on organisational size and starting maturity.

ISO 42001 certification is newer and the audit profession is still building expertise in evaluating AI governance systems. Organisations pursuing ISO 42001 should expect a less standardised experience in the short term and should work with certification bodies that have demonstrable AI governance knowledge. The documentation requirements, including AI impact assessments and records of human oversight decisions, are also less familiar to most governance teams than the information security artefacts required for ISO 27001.

One practical consideration for both standards is the ongoing commitment they require. Certification is not a one-time achievement. Surveillance audits, management reviews, and continuous improvement obligations mean that governance must remain operational between audit cycles. Organisations that treat certification as a project rather than a permanent capability tend to experience governance drift, where controls weaken over time until the next audit forces a reactive correction. Building governance as a living system from the outset is the more sustainable approach, and it is the principle that underpins how we work at moatt.

If your organisation is working through what ISO 27001 and ISO 42001 governance requirements mean in practice, or you are considering implementing both standards as part of an integrated programme, contact us to plan a conversation with our team.

Frequently Asked Questions

How do we know whether our organisation needs ISO 42001, ISO 27001, or both?

Start by asking two questions: do you handle sensitive information or operate under regulatory obligations around data security? And do you develop, deploy, or rely on AI systems to support business decisions or customer interactions? If the answer to the first question is yes, ISO 27001 is almost certainly relevant. If the answer to the second is also yes, ISO 42001 applies on top of that. Most regulated organisations today will find that both standards are relevant, since AI adoption is now widespread across sectors that already carry information security obligations.

What is the best order to implement ISO 27001 and ISO 42001 if we are starting from scratch?

For most organisations, implementing ISO 27001 first is the more practical approach. It establishes the foundational management system infrastructure — risk management processes, internal audit functions, leadership accountability structures — that ISO 42001 can then extend rather than duplicate. Once your ISO 27001 system is stable, layering in ISO 42001 controls is significantly more efficient than building both simultaneously. That said, if your organisation faces immediate regulatory pressure around AI (for example, under the EU AI Act), a parallel or accelerated ISO 42001 track may be warranted.

What is an AI impact assessment, and how is it different from a standard risk assessment under ISO 27001?

An AI impact assessment, as required by ISO 42001, evaluates the potential effects of an AI system on individuals, groups, and society — including risks of biased outputs, discriminatory decisions, lack of transparency, and erosion of human oversight. This is broader in scope than a typical ISO 27001 risk assessment, which focuses on threats to the confidentiality, integrity, and availability of information assets. A standard risk assessment might identify a data breach as a risk; an AI impact assessment might identify that a hiring algorithm systematically disadvantages certain demographic groups. Both are necessary, but they are asking fundamentally different questions.

How does the EU AI Act relate to ISO 42001, and does certification help with regulatory compliance?

The EU AI Act imposes binding requirements on providers and deployers of high-risk AI systems, covering areas such as risk management, transparency, human oversight, and data governance. ISO 42001's control framework aligns closely with these obligations, and achieving ISO 42001 certification is widely expected to serve as credible evidence of conformity with many of the Act's requirements. However, certification is not a direct legal substitute for regulatory compliance — organisations should assess their specific obligations under the Act and map ISO 42001 controls to those requirements explicitly, rather than assuming certification alone is sufficient.

What are the most common mistakes organisations make when trying to implement both standards together?

The most frequent mistake is treating the two standards as a single, unified project when they actually require distinct subject matter expertise. Information security teams are well-equipped to lead ISO 27001 implementation but often lack the AI governance knowledge needed for ISO 42001 — particularly around impact assessments, algorithmic accountability, and human oversight design. A second common mistake is under-investing in ongoing governance after initial certification, leading to the kind of governance drift described in the post. Building cross-functional teams that include both security and AI expertise from the outset, and embedding governance into operational processes rather than treating it as a compliance exercise, significantly reduces both risks.

How should we handle AI tools supplied by third parties — does ISO 42001 still apply to us as a deployer?

Yes. ISO 42001 explicitly requires organisations to define their role in the AI supply chain — as a developer, a deployer, or both — and governance obligations apply regardless of whether the AI system was built in-house or procured from a vendor. As a deployer, you are responsible for ensuring the AI system is used within its intended purpose, that human oversight mechanisms are in place, and that affected parties are treated transparently. You cannot transfer accountability for AI governance to your supplier. This means your vendor management processes — already a requirement under ISO 27001 — need to be extended to cover AI-specific due diligence, including reviewing the supplier's own AI governance practices.

How long does ISO 42001 certification typically take, and what documentation will auditors expect to see?

For organisations that already hold ISO 27001 certification and can leverage their existing management system infrastructure, ISO 42001 implementation typically takes three to six months before a certification audit, though this varies with organisational complexity and AI system scope. Auditors will expect to see an AI policy, documented AI impact assessments for systems in scope, records of human oversight procedures, evidence of staff training on AI governance responsibilities, and a process for monitoring AI system performance over time. Because ISO 42001 audit practice is still maturing, working with a certification body that has demonstrated AI governance expertise — rather than simply general management system auditing experience — is strongly advisable.

Related Articles

Share

  • October 31, 2026