ISO 42001 vs ISO 27001: What Actually Carries Over

The question we get asked first, on almost every call, is some version of: we already have ISO 27001 — how much of this do we have to do again?

The honest answer is that the frame of the question is slightly wrong. The two standards do not overlap in the way people expect. The parts that look different on paper — the clause structure, the documentation, the audit process — are nearly identical. The parts that look similar — "we already have a risk register, we already do vendor management" — are where the real work hides.

The short version

ISO/IEC 27001 protects information from harm. ISO/IEC 42001 governs the harm an AI system can cause to the people subject to its outputs.

That single distinction explains everything else. An ISMS asks whether your data is confidential, available, and intact. An AIMS asks whether your model is fair, documented, monitored, explainable, and overseen by a human with the authority and ability to intervene. Those are different questions with different evidence.

What transfers almost completely

Both standards use ISO's Harmonized Structure, so clauses 4 through 10 are structurally the same document with "information security" swapped for "AI". If your ISMS is genuinely operating — not just certified — the following transfers with modest editing:

Clause 4 (Context). Your existing analysis of organisational context and interested parties needs AI-specific additions: affected individuals, model providers, regulators with AI mandates. The process and the document both survive.

Clause 5 (Leadership). The same leadership commitment, the same accountability structures. You will add an AI policy alongside your information security policy, and you will need to name someone accountable for AI specifically.

Clause 7 (Support). Competence, awareness, communication, and documented information controls transfer wholesale. You are adding AI governance content to a training and records system that already exists — which is a very different job from building one.

Clause 9 (Performance evaluation). Your internal audit programme, audit calendar, auditor competence records, and management review cadence all extend to cover the AIMS. This is one of the largest single savings, because building an internal audit function from nothing is slow.

Clause 10 (Improvement). Nonconformity handling and corrective action processes transfer directly.

That is a real and substantial head start. It is also the least interesting part of the standard.

What does not transfer

Annex A is where the two standards genuinely diverge. ISO 27001's Annex A protects assets. ISO 42001's 38 controls govern an AI lifecycle, and most of them have no ISMS equivalent at all:

• AI system impact assessment. Assessing consequences for individuals and society is a category of analysis that does not exist in ISO 27001. There is no control you can point at and say "we already do that."
• Data for AI systems. ISO 27001 cares whether training data is secured. ISO 42001 cares about its provenance, representativeness, quality, and bias characteristics.
• AI system lifecycle documentation. Model cards, dataset documentation, evaluation results, versioned change history. Your SDLC controls touch the edge of this; they do not cover it.
• Human oversight. Meaningful, enforced, evidenced human intervention in AI decisions. No ISMS analogue.
• Information for interested parties. What you tell users and affected people about the AI system, its limitations, and its decisions.
• Third-party AI use. Your vendor management process is a useful starting point, but it was not designed to ask whether a foundation model provider's terms allocate the obligations you need flowed down.

Where the reuse estimate goes wrong

The 40–60% figure is an average, and averages hide the thing that matters. Two companies with identical ISO 27001 certificates can face very different ISO 42001 projects, and the variable is almost never the ISMS. It is engineering maturity.

A company with model versioning, reproducible training pipelines, an evaluation suite in CI, and structured inference logging is most of the way to several Annex A controls without knowing it. A company with excellent ISO 27001 documentation and models deployed from notebooks is not, regardless of how good the certificate looks.

This is also the specific reason we run gap assessments with a lawyer and an engineer in parallel rather than sequentially. The reuse question is half a documentation question and half a question about what is actually running in your pipelines, and you cannot answer it by reading policies.

The trap in "we already have a risk register"

Almost every ISO 27001-certified company tells us they have risk management covered. Almost none of them do, for AI purposes.

An information security risk register asks: what could happen to this asset, how likely is it, what would it cost us. An AI risk assessment under ISO 42001 has to consider effects on individuals and groups who are not your customers, do not have a contract with you, and may never know an AI system made a decision about them. The methodology, the risk criteria, and the treatment options are all different, and bolting AI risks onto an existing security register usually produces a register that satisfies neither purpose.

The scaffolding transfers. The analysis does not.

What to do with this

If you hold ISO 27001 and you are considering ISO 42001, the useful sequence is:

1. Inventory your AI systems first. Not your policies — your systems, including the third-party AI other teams adopted. Scope determines everything downstream.
2. Assess against Annex A specifically, not clauses 4–10. You will likely pass most of the clause requirements on the strength of your ISMS. The Annex A assessment is the one that tells you the real timeline.
3. Check engineering reality, not documentation. Ask whether an unevaluated model can reach production today. The answer predicts your implementation effort better than any document review.
4. Extend, don't duplicate. One integrated management system covering both standards, one internal audit programme, one management review. Companies that run parallel systems double their maintenance cost permanently and get no additional assurance for it.

The good news is real: ISO 27001 certification genuinely accelerates ISO 42001, and the acceleration is front-loaded in exactly the parts that are most tedious to build from scratch. Just don't budget as though Annex A is a formality.

---

Working out whether ISO 42001 is a three-month or nine-month project for you? Our AI Governance Gap Assessment produces the reuse map and a costed roadmap in three to four weeks.