ISO 42001 vs ISO 27001: Can One Audit Cover Both?
Author
Rob Hall
CEO, Tempo Audits
Key Takeaways
- ISO 27001 manages information security; ISO 42001 addresses the responsible management of AI.
- You can pursue ISO 42001 without first gaining ISO 27001 certification, though an established ISMS can provide a useful foundation.
- A combined audit can assess both systems in one coordinated process, but each standard’s requirements still need to be met.
What Do ISO 27001 and ISO 42001 Cover?
- ISO/IEC 27001 sets requirements for an information security management system, helping an organisation identify and manage risks to the confidentiality, integrity and availability of its information.
- ISO/IEC 42001 sets requirements for an artificial intelligence management system, helping an organisation govern the responsible development, provision or use of AI and manage the risks involved.
ISO 42001 vs ISO 27001: Key Differences at a Glance
An organisation can pursue either standard or both. If it holds ISO 27001 and wants ISO 42001, the existing management system may provide a useful foundation, but it still needs to address the AI-specific requirements.
Where ISO 27001 and ISO 42001 Overlap
Shared management-system foundations
Both standards follow ISO’s Harmonized Structure, with clauses 4-10 covering context, leadership, planning, support, operation, performance evaluation and improvement. Organisations can coordinate processes such as document control, internal audits and management reviews. They can also align their risk assessment and control-selection processes.
Where the requirements remain different
The risks and controls still need to be assessed against each standard. An information security risk assessment does not replace ISO 42001’s AI risk and impact assessments, and the Statement of Applicability must account for the relevant controls under each standard.
For an organisation that already holds ISO 27001, existing management-system processes can provide a foundation for ISO 42001, but AI-specific requirements still need to be addressed and evidenced.
What ISO 42001 Adds Beyond ISO 27001
ISO 27001 vs ISO 42001: Clause-by-Clause Comparison
The clauses share a common management-system structure, but their requirements are not identical. ISO 42001 applies that structure to AI management, adding specific planning and operational requirements.
For an ISO 27001-certified organisation, the structure will feel familiar, but Clauses 6 and 8 require particular attention. The AI system impact assessment appears in Clauses 6.1.4 and 8.4.
Should You Choose ISO 27001, ISO 42001, or Both?
The right starting point depends on what your organisation needs to demonstrate: information security, AI governance, or both.
1. If you are not certified to either standard
Start with the assurance need that matters most to your business. If customers or procurement teams are asking for information security assurance, ISO 27001 may be the practical first step. If your business develops, provides or relies on AI and needs to demonstrate how it governs that activity, ISO 42001 may be the stronger starting point.
2. If you already hold ISO 27001
ISO 27001 gives you useful management-system processes to build on, but it does not cover AI-specific requirements. Tempo Audits can audit both standards together when your information security and AI management systems are integrated into one central management system. In that situation, assessing shared clauses together can save around 15-20% in audit time and cost; the AI-specific risks and controls still need their own attention.
The process of identifying risks and selecting controls is broadly the same. The controls are different, because the standards deal with different risks in different ways.
3. If AI is central to your business
ISO 42001 deserves close consideration if customers ask for evidence of AI governance, or if your AI activities could raise safety, regulatory or other significant risks. ISO 27001 may also be relevant if you need to demonstrate how you manage information security. We can plan for both from the outset and run an integrated audit when the management systems are genuinely integrated.
Before deciding, ask:
- What assurance are customers and procurement teams asking us to demonstrate?
- Do we develop AI, provide AI systems, use AI, or do all three?
- Could our AI activities create safety, regulatory or other significant impacts?
What a Combined ISO 27001 and ISO 42001 Audit Looks Like
When your information security management system and AI management system are integrated, Tempo Audits can assess both standards in one coordinated audit. We review shared management-system processes together, then assess each standard’s distinct requirements and applicable controls. Combining the audit does not make the controls interchangeable.
How the audit works
We begin with the organisation’s context, scope and shared management-system processes. From there, the audit examines information security and the AI-specific risks, assessments and controls relevant to your scope. The exact audit plan depends on your AI roles, systems and management-system scope.
For a prepared organisation, the formal ISO 42001 process - from Stage 1 to certification - typically takes around three to four weeks. This is the audit phase, not the time needed to implement and prepare the system. Also, where the management systems are integrated, combining the audit can save around 15–20% in time and cost.
AI-specific evidence to prepare
Depending on your scope, we may review:
- The AI systems and roles included in the management-system scope.
- AI risk assessments, treatment decisions and the Statement of Applicability.
- AI system impact assessments and evidence of scheduled reviews.
- Records showing how relevant AI controls operate across the system lifecycle, such as development, testing, changes and monitoring.
Important note: A combined audit brings both standards into one coordinated audit plan; it does not merge them. Each management system is assessed against its own requirements. ISO 27001 certification does not, by itself, demonstrate that an organisation meets ISO 42001’s AI management requirements.
FAQs: ISO 42001 vs ISO 27001
Is ISO 27001 a prerequisite for ISO 42001?
No. An organisation can pursue ISO 42001 without first holding ISO 27001. The standards address different management systems: ISO 27001 focuses on information security, while ISO 42001 covers the responsible management of AI.
Can we reuse our ISO 27001 risk assessment for ISO 42001?
Your existing risk process can give you a useful starting point, particularly if it is already part of a well-run management system. You will still need to assess AI-related risks and impacts, though, because an information security assessment may not cover the issues involved in developing, providing or using AI.
Do the systems need to be fully integrated for a combined audit?
Not every document or control needs to be shared. To plan a combined audit, we need to see that your ISMS and AI management system are managed through a central system. That lets us review genuinely shared processes together while assessing each standard’s specific requirements.
Can an audit find a nonconformity against only one standard?
Yes. Although some processes may support both management systems, the standards have their own requirements. An issue with an AI-specific process, for example, could lead to a finding against ISO 42001 without affecting the organisation’s information security controls. If an issue affects shared processes, it may be relevant to both standards.
Does one combined audit mean one certificate?
“Combined audit” describes how the audit is planned and carried out; it doesn’t merge the standards. The audit still assesses your organisation against ISO 27001 and ISO 42001 separately. The certification documents should clearly identify which standards and organisational scope they cover.
Who should take part in a combined audit?
You won’t need every employee in every interview. The people responsible for information security, AI governance and the AI systems in scope should be available, along with process owners who support both management systems. Tempo Audits will agree the relevant people during audit planning, based on your scope and how responsibilities are organised.
Rob Hall
Book a call
No forms, no faff – just a conversation and a quote. Prefer to skip straight to it? Fill out the application form and we'll get moving.
Alternatively, if you have all the details,
fill out this form here.