Key facts

  • ISO 27001 = information security management system (ISMS); ISO 42001 = AI management system (AIMS).
  • Both use the same Annex SL high-level structure, so they integrate more easily than standards without a shared structure.
  • ISO 27001 covers confidentiality, integrity and availability of information; ISO 42001 covers AI-specific risks like bias and human oversight.
  • Holding ISO 27001 does not substitute for ISO 42001, or vice versa — they cover different risk domains.
  • Organisations with both typically run a single integrated management system rather than two separate ones.

What each standard actually manages

ISO 27001 asks: is this information asset kept confidential, intact and available to those who should have access? ISO 42001 asks a different set of questions: is this AI system's behaviour understood, is it free from unacceptable bias, can its decisions be explained, and is there effective human oversight? An organisation can be excellent at information security and still have ungoverned AI risk, and vice versa.

Why the shared structure helps

Both standards follow the same Annex SL high-level structure common to modern ISO management-system standards — context, leadership, planning, support, operation, performance evaluation, improvement. This means an organisation with an existing ISO 27001 management system already has much of the operational scaffolding (document control, internal audit, management review, corrective action) needed to add ISO 42001 alongside it, rather than starting from zero.

Do you need both?

If you process AI systems that handle sensitive data, you likely benefit from both: ISO 27001 for the data itself, ISO 42001 for the AI system's behaviour and governance. If you have no formal AI management system yet but already hold ISO 27001, extending into ISO 42001 is usually more efficient than building an AI management system independently.

Frequently asked questions

What is the difference between ISO 27001 and ISO 42001?

ISO 27001 manages information security risk (confidentiality, integrity, availability); ISO 42001 manages AI-specific risk such as bias, transparency and human oversight.

Does ISO 27001 cover AI risk?

No — it covers information security, not AI-specific risks like bias or explainability, which ISO 42001 addresses.

Can you run ISO 27001 and ISO 42001 together?

Yes — both share the same Annex SL structure, so most organisations integrate them into a single management system rather than running two separate ones.

Do we need ISO 42001 if we already have ISO 27001?

If you use AI systems, yes — ISO 27001 does not substitute for ISO 42001; they manage different risk domains.

Is it faster to add ISO 42001 if you already have ISO 27001?

Usually — much of the operational scaffolding (document control, internal audit, management review) already exists and can be extended rather than rebuilt.

Related pages

Sources

Last updated 19 June 2026.