ISO/IEC 42001 versus ISO 27001: what AI companies actually need

ISO/IEC 27001 is the established standard for an information security management system. It certifies that your organisation identifies, assesses and treats information security risk through a managed, audited process. Enterprise procurement teams know it and many require it.

ISO/IEC 42001, published in December 2023, is the first international standard for an AI management system. It certifies that your organisation manages the risks specific to developing or operating AI: intended use, data quality, transparency, human oversight and the lifecycle of AI systems.

Both standards follow the same management-system structure: leadership commitment, risk assessment, controls, internal audit and continual improvement. An organisation with a working ISO 27001 programme already has much of the machinery ISO/IEC 42001 expects. The policies, the audit rhythm and the corrective-action process carry across.

ISO 27001 treats AI as another information asset. ISO/IEC 42001 asks questions 27001 does not: What is each AI system intended to do, and what is it prohibited from doing? How is training and input data governed? Who can override the system, and how is that oversight evidenced? How are AI-specific risks assessed before deployment and monitored after? For a company whose product is an AI feature, these are the questions enterprise security teams now ask in due diligence.

If you have neither, ISO 27001 usually comes first: it is the broader requirement, more often demanded in procurement, and it builds the management system ISO/IEC 42001 extends. If you already hold ISO 27001 and your product is AI, ISO/IEC 42001 is the differentiator that answers the questions your buyers' security teams are starting to ask. The right sequence depends on what your target customers require, which is a scoping question, not a guess.