Integrating ISO 42001 with existing systems

Many organisations already run management systems. ISO 27001 for information security, ISO 9001 for quality and perhaps ISO 14001 for the environment. ISO 42001  does not have to become a new island. Thanks to the shared High Level Structure , integration is not only possible, it is smart.

Why integrate ISO 42001 with existing systems?

Separate management systems lead to:

• Duplicate work (documenting the same processes several times)
• Inconsistency (different approaches to similar matters)
• Audit fatigue (several audits per year)
• Fragmentation (nobody has an overview)

Integration solves this. You build one system that meets several standards. That is more efficient, more consistent and easier to manage.

The High Level Structure of ISO 42001

All modern ISO management system standards follow the same structure: the High Level Structure (HLS). This is by design, not by chance. It makes integration possible.

ISO 27001, ISO 9001, ISO 14001, ISO 45001 and ISO 42001 all follow this structure. They share the same clauses, the same concepts and the same terminology.

This means you can share a lot:

• One governance structure
• One policy hierarchy
• One audit programme
• One management review
• One improvement process

ISO 42001 + ISO 27001

This is the most logical combination. AI processes data, and data must be protected. Information security and AI governance are closely related.

What can you share?

Governance and leadership: The same top management that runs the ISMS can run the AIMS. The same roles, such as the Information Security Officer, can be extended.

Risk management: The process is the same: identify, assess, treat. You add AI-specific risks to your existing register.

Document control: One system for all your procedures. No separate wikis.

Internal audit: One audit programme that covers both standards. Auditors who can assess both aspects.

Management review: One review that covers information security and AI governance.

Training and awareness: Combined training that covers both subjects.

What needs to be separate?

The controls: ISO 27001 has 93 controls for information security. ISO 42001 has 38 controls for AI. They partly overlap but are not the same.

The risk analysis: Security risks are different from AI risks. Bias and explainability are not traditional security topics.

The impact assessment: Specific to ISO 42001. It is not standard in ISO 27001.

Practical approach

If you have ISO 27001:

1. Extend your scope to include AI
2. Add AI risks to your risk register
3. Create a separate Annex A mapping for ISO 42001
4. Implement the AI-specific controls
5. Update your policy to cover AI
6. Train your team on AI governance
7. Have a combined audit carried out

The foundation is already there. You add the AI layer.

ISO 42001 + ISO 9001

ISO 9001 is about quality. AI can have a major impact on product quality. The combination is less obvious than with ISO 27001, but it is logical.

The points of contact

Quality of AI output: If AI is part of your product or service, the quality of that AI falls within your ISO 9001 scope.

Process management: Both standards require controlled processes, documentation and monitoring.

Customer satisfaction: If AI affects the customer experience, it is relevant to ISO 9001.

Practical integration

You integrate AI as part of your product realisation (clause 8 of ISO 9001). The AI-specific requirements from ISO 42001 become part of your quality system.

ISO 42001 + other standards

ISO 14001 (Environment)

At first glance, this seems unrelated to AI. But AI is increasingly used for sustainability: optimising energy use, predictive maintenance and supply chain efficiency.

If you use AI for environmental goals, the two systems affect each other.

ISO 45001 (Occupational health and safety)

AI can affect working conditions. Think of automation, workload caused by AI monitoring and the ergonomics of human-AI interaction.

In industrial settings where AI controls machines, the link is direct.

NEN 7510 (Healthcare)

For healthcare organisations that use AI, the combination of ISO 42001 and NEN 7510 is relevant. Patient data, AI in diagnostics and decision support.

The integrated management system (IMS)

An Integrated Management System combines several standards in one system. It has:

One policy document that covers all standards. Or an overarching policy with standard-specific elaborations.

One governance structure. Perhaps a Management System Manager who oversees all systems, with standard-specific specialists below them.

One process architecture. Processes that meet several standards.

One audit programme. Combined audits or a rotating schedule.

One improvement system. Nonconformities and improvements in one database.

Advantages

• Efficiency (less duplicate work)
• Consistency (one way of working)
• Overview (everything in one place)
• Lower audit costs
• Better acceptance (one system to learn)

Challenges

• Complexity at the start
• More knowledge required (understanding all the standards)
• Risk that details get lost
• Not every certification body offers every combination

The practical steps

If you start with ISO 42001 and already have something in place:

Step 1: Take stock of what you have Which systems are running? What are the points of contact with AI?

Step 2: Decide on the integration strategy Fully integrated, or separate modules with a shared core?

Step 3: Identify what you can reuse Processes, documentation, tools and roles.

Step 4: Identify what is new AI-specific elements, new risks and impact assessments.

Step 5: Plan the implementation What comes first? How do you communicate it?

Step 6: Update your existing system Extend it instead of building alongside it.

Step 7: Train your team On the new elements, and on how everything fits together.

If you have nothing in place:

Consider building in an integrated way from the start. Implementing ISO 27001 and ISO 42001 at the same time is not much heavier than implementing either one alone, but it delivers more.

Common mistakes in integration

Moving too fast: Understand your existing system properly before you build on it. Otherwise you create a mess.

Copying too much: ISO 42001 is not ISO 27001 with “AI” added. The AI-specific elements deserve real attention.

Nobody with an overview: Integration needs someone who understands both (or all) of the standards. Otherwise inconsistencies emerge.

Not involving the certification body early: If you want a combined audit, check early whether your certification body offers one and what the conditions are.

The investment

Integration requires more planning upfront, but it saves time and money later.

The savings grow over the years through lower maintenance and audit costs.

Documentation when integrating

An integrated system requires smart documentation.

Shared documents:

• Management system manual (overarching)
• Governance structure
• Audit programme
• Improvement procedure

Standard-specific documents:

• Statement of Applicability per standard
• Risk register with all risks (tagged per standard)
• Standard-specific procedures where needed

Tools: Consider software that supports several standards. Many GRC (governance, risk and compliance) platforms can do this.

Next steps

If you want to integrate:

1. Read the standards you want to combine
2. Map the overlap: what is the same?
3. Identify the gaps: what is unique?
4. Talk to your certification body about combined audits
5. Plan the approach: gradual or all at once?

Further reading

• ISO 42001 vs ISO 27001 - The comparison
• Step-by-step plan - The implementation route
• What is ISO 27001? - The information security standard
• Common mistakes - What to avoid