ISO 42001 and ISO 27001 Integration

Key Takeaways

Quick Answer: ISO 42001 and ISO 27001 share the same clause structure (4-10), making integration straightforward. Organizations with existing ISO 27001 certification can extend their ISMS to include AI management, reducing implementation effort by 30-50% and enabling combined audits.

Why Integrate?

The Case for Integration

When to Integrate

Integrate if:

• You have existing ISO 27001 certification
• AI systems process information assets
• Same teams manage security and AI
• Seeking efficiency in compliance

Consider separate systems if:

• Very different organizational units manage security vs. AI
• AI scope is significantly different from ISMS scope
• Phased implementation preferred

Structural Alignment

Shared Clause Structure

Both standards follow ISO High-Level Structure (Annex SL):

Integration by Clause

Clause 4: Context of the Organization

Integration example:

"The integrated management system covers information security and AI management for [Organization Name]. The scope includes all information assets supporting business operations and all AI systems developed and deployed by the organization."

Clause 5: Leadership

Policy integration options:

Clause 6: Planning

Risk assessment integration:

1Integrated Risk Assessment
2────────────────────────────────────────────────────
3
4Information Security Risks (ISO 27001):
5├── Confidentiality risks
6├── Integrity risks
7└── Availability risks
8
9AI-Specific Risks (ISO 42001):
10├── Bias and fairness risks
11├── Transparency risks
12├── Data quality risks
13├── Human oversight risks
14└── AI subject impact risks
15
16Shared/Overlapping Risks:
17├── AI system security risks
18├── Training data security
19├── Model integrity risks
20└── AI availability risks

Clause 7: Support

Documentation structure:

1Integrated Documentation
2────────────────────────────────────────────────────
3
4Level 1: Integrated Management Policy
5         └── Security and AI commitments
6
7Level 2: Core Procedures
8         ├── Risk assessment (security + AI)
9         ├── Incident management (security + AI)
10         ├── AI impact assessment
11         └── Change management
12
13Level 3: Standards
14         ├── Security standards
15         ├── AI development standards
16         └── Data quality standards
17
18Level 4: Records
19         ├── Risk registers (security + AI)
20         ├── Impact assessments
21         └── Audit records

Clause 8: Operation

Clause 9: Performance Evaluation

Integrated audit approach:

Clause 10: Improvement

Control Mapping

Overlapping Controls

ISO 42001-Specific Controls

These ISO 42001 controls address AI-specific concerns not covered by ISO 27001:

ISO 27001 Controls Relevant to AI

Statement of Applicability Integration

Approach Options

Example Integrated SoA Structure

Implementation Approach

Starting Point: Existing ISO 27001

If you have ISO 27001 certification:

Starting Point: No Existing Certifications

If pursuing both certifications:

Recommendation: For AI-native organizations, simultaneous implementation is most efficient. For others, ISO 27001 first provides a solid foundation.

Integration Timeline

Adding ISO 42001 to Existing ISO 27001:

Audit Considerations

Combined Audits

Audit Options

Challenges and Solutions

Challenge 1: Different Scopes

Problem: ISMS covers entire organization, AI systems are in specific area

Solution:

• Define clear scope boundaries
• Show relationships in documentation
• Explain scope relationship to auditors

Challenge 2: Different Risk Appetites

Problem: Information security risk tolerance differs from AI risk tolerance

Solution:

• Document distinct risk criteria where needed
• Unified risk methodology with different thresholds
• Clear escalation for AI-specific risks

Challenge 3: Different Stakeholders

Problem: Security team manages ISMS, AI team manages AI

Solution:

• Clear roles and responsibilities
• Regular coordination meetings
• Shared governance structure

Challenge 4: Documentation Volume

Problem: Two standards = too much documentation

Solution:

• Integrated documentation structure
• Shared procedures where possible
• Clear cross-references

Recommended Integration Pattern

1Integrated Management System Structure
2────────────────────────────────────────────────────
3
4                    ┌─────────────────────────┐
5                    │   Executive Sponsor     │
6                    └───────────┬─────────────┘
7                                │
8                    ┌───────────▼─────────────┐
9                    │ Integrated MS Owner     │
10                    │ (ISMS + AIMS)           │
11                    └───────────┬─────────────┘
12                                │
13          ┌─────────────────────┼─────────────────────┐
14          │                     │                     │
15┌─────────▼─────────┐ ┌─────────▼─────────┐ ┌─────────▼─────────┐
16│ Security Team     │ │ AI Team           │ │ Common Functions  │
17│ (ISMS focus)      │ │ (AIMS focus)      │ │ (Shared)          │
18└───────────────────┘ └───────────────────┘ └───────────────────┘
19          │                     │                     │
20          └─────────────────────┴─────────────────────┘
21                                │
22                    ┌───────────▼─────────────┐
23                    │ Integrated Processes:   │
24                    │ • Risk Assessment       │
25                    │ • Internal Audit        │
26                    │ • Management Review     │
27                    │ • Incident Management   │
28                    │ • Document Control      │
29                    └─────────────────────────┘

Need help integrating ISO 42001 with your existing certifications? Talk to our team