ISO 42001 vs ISO 27001

ISO 42001 and ISO 27001 look alike. They share the same structure through the High Level Structure , the same approach and similar processes. Even so, they are different standards with a different focus. On this page, we explain the differences and discuss how to combine them.

The core difference between ISO 42001 and ISO 27001

ISO 27001 is about information security. How do you protect information against unauthorised access, loss or damage? The focus is the confidentiality, integrity and availability of information.

ISO 42001 is about AI governance. How do you ensure that AI is responsible, transparent and reliable? The focus is the impact of AI on people, the fairness of decisions and the explainability of systems.

There is overlap. AI systems process information, so security is relevant to AI. But the angle is fundamentally different.

Structural comparison: ISO 42001 vs ISO 27001

Both standards follow the High Level Structure (HLS). The clause structure is identical:

Clause	ISO 27001	ISO 42001
4	Context of the organisation	Context of the organisation
5	Leadership	Leadership
6	Planning	Planning
7	Support	Support
8	Operation	Operation
9	Performance evaluation	Performance evaluation
10	Improvement	Improvement

The content of these clauses is comparable. If you know ISO 27001, you will recognise the structure of ISO 42001 immediately.

The main difference lies in the annexes. ISO 27001 has an Annex A with 93 controls for information security. ISO 42001 has an Annex A with 38 controls for AI governance.

What does ISO 42001 have that ISO 27001 does not?

AI-specific risk analysis

ISO 42001 requires you to assess AI-specific risks. Not only security risks, but also:

Model drift (the model gets worse over time)
Bias and discrimination
Decisions that cannot be explained
Misuse of AI
Technical limitations of AI

Impact assessment

The AI impact assessment is unique to ISO 42001. You assess not only risks to the organisation, but also the impact on individuals, groups and society.

Who is affected if the AI makes mistakes?
How serious is that?
Are certain groups systematically disadvantaged?
Can people understand and challenge the decisions?

Lifecycle management of AI

ISO 42001 explicitly addresses the entire lifecycle of AI:

Development and training
Testing and validation
Deployment
Monitoring after deployment
Model updates and retraining
Decommissioning

Data governance for AI

The controls for data in ISO 42001 are AI-specific:

Origin of training data
Quality and representativeness of data
Labelling of data
Bias in datasets

Explainability and transparency

ISO 42001 requires:

Clarity about when people are dealing with AI
Explanation of how AI decisions are reached
Information provided to users and interested parties

What does ISO 27001 have that ISO 42001 does not?

Depth in information security

ISO 27001 goes much deeper into security measures:

Cryptography and key management
Network segmentation
Physical security
Access management
Incident management
Business continuity

ISO 42001 does address security, but not with the same depth.

Information classification

ISO 27001 requires you to classify information by sensitivity and apply appropriate protection. This concept does not exist in the same form in ISO 42001.

Supplier security

ISO 27001 has extensive measures for supplier security. ISO 42001 has supplier controls too, but they focus on AI-specific aspects.

The overlap between ISO 42001 and ISO 27001

There is significant overlap at process level:

Governance: Both require policy, roles and responsibilities
Risk analysis: Both use a risk-based approach
Documentation: Both require documented processes and evidence
Internal audit: The same approach
Management review: The same process
Continual improvement: The same method

If you have one of the two, you can reuse much of it for the other.

The High Level Structure was designed deliberately to make integration easier. You can set up one integrated management system that covers both standards.

When do you need ISO 42001 and when ISO 27001?

ISO 27001 only

You process information but do not use AI. Or you use minimal AI with no significant impact.

Examples:

An accountancy firm that processes sensitive client data
A hosting company
A hospital (supplemented by NEN 7510)

ISO 42001 only

You develop or use AI, but information security is less critical or is already addressed in other ways.

This scenario is rare. AI systems almost always process data, so security is relevant.

Both standards

You process sensitive information and you use AI with an impact on people.

This is the most common scenario for organisations that are seriously working with AI.

Examples:

A fintech company with AI-driven credit assessment
An HR tech company with AI-driven recruitment
A healthcare AI company
An AI platform that processes client data

How do you combine ISO 42001 and ISO 27001?

Integrated management system

You build one management system that covers both standards. The processes (governance, audit, review) are shared. The controls are complementary.

Advantages:

Efficiency: no duplicate work
Consistency: one policy, one governance structure
Overview: one system to manage

Disadvantages:

Complexity: a larger scope in one system
Expertise: you need knowledge of both standards

Combined audits

You can combine the certification audits. One auditor (or team) assesses both systems at the same time. This saves time and money.

Most certification bodies offer this.

Sequential approach

If you already have one of the standards, you build the other on top of it.

ISO 27001 first, ISO 42001 later: You already have the governance structure, the audit processes and document control. You add the AI-specific elements.

ISO 42001 first, ISO 27001 later: Less common, but possible. You have the governance, but you need to build out the information security controls.

Practical tips

If you have ISO 27001

You have a head start. Many processes can be reused:

Governance structure
Risk management process
Audit programme
Document control
Management review

What you need to add:

AI-specific risk analysis
Impact assessments
AI controls (Annex A)
Lifecycle management for AI
Data governance for AI

If you have nothing

Start with the standard that is most urgent for your business.

Choose ISO 27001 first if:

You already process sensitive data
Clients ask for ISO 27001
AI is still in development

Choose ISO 42001 first if:

AI is at the core of your business
The EU AI Act applies to you directly
Clients ask about AI governance

Or build an integrated system straight away.

One management system, two certificates

This is the most efficient scenario. You have:

One policy document that covers both
One governance structure
One risk management process (with two perspectives: security and AI)
One audit programme
One management review
Two Statements of Applicability (one per standard)
Two certificates

Cost of combining ISO 42001 and ISO 27001

The combination costs less than two separate projects.

Scenario	Implementation	Audit
ISO 27001 only	€15,000 - €50,000	€6,000 - €15,000
ISO 42001 only	€15,000 - €75,000	€8,000 - €20,000
Both separately	€30,000 - €125,000	€14,000 - €35,000
Integrated	€25,000 - €100,000	€10,000 - €28,000

The savings come from the shared processes and the combined audit.

The future of ISO 42001 and ISO 27001

The combination of information security and AI governance is becoming more common. AI systems are information-processing systems by definition. Good AI governance without security is incomplete.

Expect organisations that work seriously with AI to implement both standards, integrated or not.

The EU AI Act reinforces this. The law requires both cybersecurity and responsible AI. The combination of ISO 27001 and ISO 42001 covers both.