ISO 42001 vs ISO 27001: What's the Difference, and Do You Need Both?
Last updated:11 November 2026
Security questionnaires now ask which AI tools employees use, what data goes into them, and who reviews the output. An ISO 27001 certificate answers only part of that.
Many companies can’t yet name the tools: in a 2026 Bitdefender survey of 1,200 IT and security professionals, 47% said they lack visibility into the shadow AI tools employees use.
TechMagic got the same questions from clients. Our governance was built on ISO 27001, which covered access control, suppliers, and data classification. The ISO 42001 vs ISO 27001 question came down to what AI adds: an AI policy, a named owner, and an assessment of each tool’s impact on people.
We extended that system to AI and achieved ISO 42001 certification. After passing both, we know where the standards overlap and where AI needs new work. This article covers what each standard governs, how they differ, when a company needs both, and the decisions behind our certification.
Key Takeaways
- ISO 27001 governs information security: the confidentiality, integrity, and availability of data, with or without AI.
- ISO 42001 governs the responsible development and use of AI, including bias, transparency, and impact on people.
- Both share one management-system structure, so an ISO 27001 program carries much of the ISO 42001 work.
- The need for both depends on how central AI is to a company’s product and customers.
What Is ISO 27001, and What Does It Actually Cover?
ISO 27001 is the international standard for an information security management system (ISMS). It sets requirements for protecting the confidentiality, integrity, and availability of information, including data that AI tools process.
Scope and purpose
The current edition, ISO/IEC 27001:2022, sets its requirements in clauses 4 to 10. The 93 Annex A controls fall into four themes: 37 organizational controls, 8 people-related, 14 physical, and 34 technological.
Risk management is the core. An organization identifies information security risks and selects appropriate controls to treat them. A risk treatment plan sets the response to each one, and the Statement of Applicability records which Annex A measures apply.
Typical areas include access control, asset management, and incident response. Technical controls add measures such as secure authentication and logging.
Who typically pursues it
ISO 27001 is most relevant when an organization handles sensitive data for clients. For a software company selling to enterprises, the certificate is often the baseline proof of data security, showing that safeguarding data rests on audited processes.
North American buyers may ask for a SOC 2 report instead or as well, and the ISO 27001 vs SOC 2 choice usually follows where the customers are.
What Is ISO 42001, and What Does It Actually Cover?
ISO 42001 is the global standard that defines an artificial intelligence management system (AIMS), first issued in December 2023. It governs the responsible development, provision, and use of AI systems. It also covers what ISO 27001 leaves open: fairness, transparency, explainability, and other AI-specific risks.
Scope and purpose
The full name is ISO/IEC 42001:2023, sometimes written as ISO IEC 42001. Its requirements sit in the same clauses 4 to 10 as ISO 27001. Annex A holds 38 AI controls under nine objectives, covering areas such as data, system development, and third-party relationships.
The AI risk assessment follows the same logic as in ISO 27001 but focuses on issues such as algorithmic bias, poor data quality, and opaque decisions. The AI system impact assessment has no ISO 27001 equivalent. It looks at consequences for individuals, groups, and society, so ethical considerations become part of the review.
Annex A also covers AI lifecycle management, ongoing monitoring, and human oversight. The life cycle requirements matter most for organizations that build or deploy their own AI.
Who typically pursues it
Any organization that develops, provides, or uses AI can pursue ISO 42001. An AI company selling AI models faces the most direct pressure. Companies that rely on third-party AI tools certify too, to prove responsible AI management.
That was TechMagic’s case. We defined our role as an AI user, so our AIMS governs how employees use third-party AI tools.
Yevhenii K., Information Security Manager, explains who benefits most:
“ISO 42001 matters most for software and SaaS companies that build AI features for enterprise clients, AI product companies, and organizations in regulated industries such as finance and healthcare. It also fits companies like TechMagic that use many third-party AI tools and need to show clients their data is protected.”
ISO 42001 vs ISO 27001: What Are the Key Differences?
ISO 42001 and ISO 27001 are built on the same management-system structure, but each addresses its own risks with a separate set of controls. The table below gives a quick ISO 42001 vs ISO 27001 comparison. The sections after it explain the ISO 42001 vs ISO 27001 differences that have the biggest impact.
Different risks, different controls
The core ISO 42001 and ISO 27001 difference is the risk lens. ISO 27001 controls address risks to information, while ISO 42001 asks whether an AI system behaves as intended and treats people fairly.
A model can run in a well-secured environment and still give biased results because of skewed training data. ISO 42001 covers this with AI-specific requirements built for the unique challenges AI poses, such as controls on data quality for AI systems and an assessment of the impact on people.
That is the practical difference between ISO 42001 and ISO 27001: one protects information, and the other governs how AI systems use it and affect people.
Different reasons companies pursue each one
Like most security standards, ISO 27001 helps a company prove robust security to customers and auditors. ISO 42001 demonstrates responsible AI governance, and buyers read it as evidence of ethical AI practice backed by an independent audit.
Demand for it usually comes from AI sections in RFPs and security questionnaires, board questions about AI ethics, or new AI regulations such as the EU AI Act.
In any ISO 42001 vs 27001 decision, the first question is what the company needs to prove and to whom. The choice of controls follows from that.
Where Do ISO 27001 and ISO 42001 Overlap?
ISO 27001 and ISO 42001 overlap in clauses 4 to 10, so a mature ISO 27001 program already has much of what an AIMS needs.
Shared management-system structure
ISO standards for management systems follow one harmonized structure, set out in Annex SL. In an ISO/IEC 42001 vs ISO/IEC 27001 comparison, clauses 4 to 10 carry the same headings:
- Context of the organization, including internal and external factors and interested parties
- Leadership, including leadership commitment, policy, and roles
- Planning, including risk assessment, risk treatment, and objectives
- Support, including resources, competence, awareness, and documented information
- Operation, including carrying out the planned assessments and risk treatment
- Performance evaluation, including monitoring, internal audits, and management review
- Improvement, including corrective action and continual improvement
Reusable ISO 27001 processes
When TechMagic extended its ISMS to AI, most core processes needed only AI additions. These included risk assessment, document control, internal audit, management review, supplier and incident management, training, asset and access management, and information classification.
In practice, AI risks went through the same assessment method with the same risk levels, and AI tools were recorded as information assets. AI vendors fell under existing supplier management. Both ISO standards, together with ISO 9001, now run as one integrated management system with one joint internal audit.
Some work is new for an ISO 27001 program: the AI policy, governance structures for AI, and the AI system impact assessment. The Annex A controls on data for AI systems, responsible AI use, and the AI lifecycle, where it applies, also need new processes.
Do Companies Need ISO 42001 if They Already Have ISO 27001?
A company needs ISO 42001 when AI is a meaningful part of what it builds, sells, or relies on. The second signal is customers or regulators asking for proof of AI governance.
When ISO 27001 alone is still enough
In the ISO 27001 vs 42001 decision, ISO 27001 alone usually covers a company when:
- The product ships no AI features, and no customer has asked about AI governance.
- AI use is limited to approved productivity tools with clear data rules.
Even then, an AI acceptable use policy helps manage risks and protect data privacy.
When AI governance needs its own certification
A company should pursue certification when one or more of these apply:
- The product includes AI models, agents, or scoring logic that customers rely on.
- Enterprise buyers send questionnaires with AI governance sections.
- AI operations span delivery and support, and clients ask how their data is handled.
- The company sells into the EU and needs a base for AI Act compliance.
Agents add another layer of risk. In Deloitte’s 2026 State of AI in the Enterprise survey, only 21% of companies planning to deploy agentic AI reported a mature model for agent governance. ISO 42001 and ISO 27001 do not test how an agent behaves, so agent-based products also need agentic AI security testing.
We also asked Yevhenii K., Information Security Manager, who helped build our AIMS.
Expert view: Does ISO 42001 certification prove EU AI Act compliance?
“ISO 42001 gives a company the governance base the EU AI Act expects: AI risk management, impact assessment, human oversight, AI training, and documented responsibilities. However, ISO 42001 is not a harmonized standard under the AI Act, so certification does not by itself prove AI Act compliance. Requirements specific to high-risk AI systems, such as conformity assessment, technical documentation, and registration, have to be met separately.”
How to Add ISO 42001 to an Existing ISO 27001 Program
Start with a gap assessment against the AIMS-specific clauses and controls, then extend the existing ISMS instead of building a second system.
Scope → Gap analysis → AI risk and impact assessment → Controls and training → Internal audit and management review → Certification audit
A gap assessment against AIMS requirements
First, the company sets the AIMS scope and its role. An AI provider that builds its own models has more controls to cover than an AI user of third-party tools. A gap analysis then compares existing processes with each ISO 42001 requirement and Annex A control, with data science leads involved if the company builds AI.
One integrated system and audit cycle
The AI risk assessment can run through the same risk management framework as information security risks. Tools that may affect people also get an AI impact assessment, and data governance rules set what data each tool or model may receive. Companies that build AI add owners and risk mitigation plans for AI-specific issues such as model drift.
The Statement of Applicability then records which Annex A controls apply. Before the certification audit, one internal audit and one management review can cover both standards. With risk governance in one cycle, it is easier to maintain compliance through annual surveillance audits.
Our Experience Helping Companies Build Compliant Security and AI Governance Programs
TechMagic went through this process before advising clients on it. We extended our management system, already certified to ISO 27001 and ISO 9001, to cover AI. An independent certification body issued our ISO/IEC 42001 certificate about three months after the project began.
These decisions shaped the project:
- Data controls for an AI user. We first excluded the Annex A data controls. They also cover data employees enter into AI tools, so they went back into scope.
- Screening before impact assessments. Four questions decide which tools need a full assessment: personal data, decisions about individuals, contact with clients or the public, and decisions without human review.
- A named accountable owner. Auditors expect a specific person responsible for AI governance, and a role described in general terms is not enough. At TechMagic, the CTO is formally accountable for AI governance.
Our Statement of Applicability records a decision for each of the 38 Annex A controls. All nine life cycle controls were marked not applicable, because vendors develop and deploy the tools we use.
“Because we built it on our existing ISO 27001 and ISO 9001 processes, AI governance didn’t become extra bureaucracy; it became part of how we already work.” – Yevhenii K., Information Security Manager
For Haiqu, a quantum computing platform, our consultants built an ISMS and helped the company achieve ISO 27001 certification. The same program covered Microsoft SSPA/DPR attestation and SOC 2 readiness, as the Haiqu security program case study shows. Another example is the Quizrr ISMS internal audit.
Need Expert Help With ISO 42001 or ISO 27001?
TechMagic prepares companies for ISO 27001 audits and ISO 42001 audits, and an accredited certification body issues the certificate.
Final Thoughts
ISO 27001 protects information, and ISO 42001 governs how AI is developed and used. For a company that already holds ISO 27001, the ISO 27001 vs ISO 42001 differences are smaller in practice than on paper. The shared structure lets ISO 42001 build on processes already in place.
Where is this heading?
- AI regulation will cover most of the world’s economies. Gartner expects fragmented AI regulation to quadruple and extend to 75% of the world’s economies by 2030.
- Governance budgets will grow. The same Gartner release expects spending on AI governance to reach $492 million in 2026 and pass $1 billion by 2030.
- Agents will raise buyer expectations. Close to three-quarters of companies plan to deploy agentic AI within two years, according to Deloitte. Buyers will ask how those agents are governed.
For most companies with ISO 27001, the ISO 42001 versus ISO 27001 question ends in a plan more often than a choice. Both standards also expect continuous improvement, so that plan goes on after the certificate is issued.
FAQ
The main difference between ISO 27001 and ISO 42001 is their subject. ISO 27001 governs information security through an information security management system (ISMS), and ISO 42001 governs artificial intelligence through an AI management system (AIMS).
ISO 42001 does not replace ISO 27001. ISO 42001 covers AI risks such as bias, while ISO 27001 covers information security, so a company that needs both keeps both.
A company needs both ISO 27001 and ISO 42001 when AI is central to its product or operations and customers ask for proof of AI governance. When AI plays a minor role, ISO 27001 alone can be enough for now.
An ISO 42001 AI management system (AIMS) can be built on an existing ISO 27001 information security management system (ISMS), because both share one harmonized structure. Both standards also require a documented risk treatment plan, so AI risks can go through the same method. The AI impact assessment and AI-specific Annex A controls are the main new work.
ISO 42001 has 38 Annex A controls under nine control objectives. The 2022 edition of ISO 27001, released that October, sets out 93 Annex A controls across four themes: organizational, people, physical, and technological.
ISO 42001 has four annexes, while ISO 27001 has one. Annex A lists the 38 controls, and Annex B gives implementation guidance for each of them. Annex C lists potential AI objectives and risk sources, and Annex D explains how the AIMS applies across sectors.
ISO 42001 certification fits AI product companies, SaaS companies building AI features for enterprises, and regulated sectors such as finance and healthcare. ISO 42001 also fits heavy users of third-party AI tools. The standard asks each organization to define its role, such as AI provider, AI producer, or AI customer.
TechMagic helps companies with gap assessments, implementation, internal audits, and audit preparation for ISO 27001 and ISO 42001. TechMagic runs ISO 27001, ISO 9001, and ISO 42001 as one integrated management system, so our consultants advise on work they have done themselves.
