In brief
Integrating ISO 27001 and ISO 42001 means one management system with shared audit, review and document control, plus separate AI impact and lifecycle work.
Integrating ISO 27001 and ISO 42001 works because both standards use ISO's harmonized management-system structure (clauses 4 to 10). An organization with a running ISMS can extend scope, policy, competence, document control, internal audit, management review and corrective action to cover its AI management system (AIMS). The AI-specific parts still need their own work: AI system impact assessment, AI lifecycle controls, data for AI and information for affected parties.
Why can ISO 27001 and ISO 42001 share one management system?
ISO publishes its management system standards on a common harmonized structure: the same clause headings and much of the same core text for context, leadership, planning, support, operation, performance evaluation and improvement. ISO/IEC 27001:2022 and ISO/IEC 42001:2023 both follow it, so one set of processes can serve both standards when each process records which standard's criteria it applies.
What differs is the subject. ISO 27001 manages information security risk and lists 93 reference controls in four themes in its Annex A. ISO 42001 manages risks and impacts of AI systems and lists 38 reference controls in nine groups (A.2 to A.10) in its own Annex A, with implementation guidance in Annex B. Each standard needs its own Statement of Applicability: ISO 27001 under clause 6.1.3 and ISO 42001 under its clause 6.1.3.
Which processes can be shared?
| Process | Clause (both standards) | How to integrate |
|---|---|---|
| Context and scope | 4.1 to 4.4 | One context analysis; the AIMS scope names the AI systems and roles (developer, provider, user) in it |
| Policy | 5.2 | Keep a separate AI policy (ISO 42001 A.2.2) and align it with the security policy (A.2.3) |
| Competence and awareness | 7.2, 7.3 | One training record; add AI responsibilities by role |
| Documented information | 7.5 | One version, approval and retention method for both systems |
| Internal audit | 9.2 | One audit programme with separate criteria for the ISMS and the AIMS |
| Management review | 9.3 | One review with the inputs each standard requires |
| Nonconformity and corrective action | 10.2 | One workflow for root cause, owner, deadline and effectiveness check |
What must stay AI-specific?
These requirements have no ISO 27001 equivalent and cannot be covered by reusing security evidence:
- AI system impact assessment (ISO 42001 clause 6.1.4 and A.5): consequences for individuals, groups and society, not only for the organization's information.
- AI system life cycle (A.6): requirements, design documentation, verification and validation, deployment, operation and monitoring, technical documentation and event logs for each AI system.
- Data for AI systems (A.7): acquisition, quality, provenance and preparation of training and operational data.
- Information for interested parties (A.8): documentation for users, external reporting and communication of AI incidents.
- Responsible use (A.9) and third-party and customer relationships (A.10), including AI suppliers such as model API providers.
Where do ISO 27001 controls partly support ISO 42001?
Some security controls produce evidence the AIMS can reuse, but none satisfies the AI requirement on its own. A control map should record what is reused and what gap remains.
| ISO 27001:2022 control | ISO 42001 control it supports | Gap that remains |
|---|---|---|
| A.5.19 to A.5.22 Supplier relationships | A.10.3 Suppliers | AI-specific supplier risk: model behaviour, data use, change notices |
| A.8.15 Logging | A.6.2.8 AI system recording of event logs | Which AI events to log and for how long, per system |
| A.5.24 to A.5.28 Incident management | A.8.4 Communication of incidents | Who outside the organization must be told about an AI incident |
| A.8.25 Secure development life cycle | A.6.2.2 to A.6.2.5 Requirements, design, verification and validation, deployment | Model-specific validation criteria and release decisions |
How do you integrate the two systems step by step?
- List current ISMS processes and the evidence each produces.
- Build the AI system inventory: purpose, model, data, affected parties, owner and human oversight. See the AI system inventory guide.
- Map ISO 42001 requirements against existing processes by objective, not by clause title.
- Add the AI system impact assessment method and extend the risk method with AI risk sources.
- Prepare a separate ISO 42001 Statement of Applicability against its Annex A.
- Update the internal audit programme and management review agenda for both systems.
- Ask your certification body whether it can audit both standards together; it must be able to certify AI management systems (ISO/IEC 42006:2025 sets requirements for those bodies).
How does pTrackly support an integrated ISMS and AIMS?
pTrackly includes ISO 27001 and ISO 42001 as frameworks with a compliance matrix for each (clauses and Annex A). Controls are shared: a policy published or an evidence task completed counts toward every framework it is linked to, while each framework keeps its own score. Adding ISO 42001 brings AI policy templates (AI policy, AI risk management and impact assessment, AI data governance, AI system lifecycle, AI third-party and supplier) and their evidence tasks. Read-only integrations with AI platforms such as OpenAI, Anthropic, AWS Bedrock and MLflow collect supporting evidence, and the risk register holds AI risks next to security risks. Your team still decides scope, carries out impact assessments and signs the Statement of Applicability; an accredited certification body issues the certificate. See the ISO 27001 and ISO 42001 framework pages and how long ISO 42001 certification takes for an ISO 27001 holder.
Frequently asked questions
Can one audit cover both ISO 27001 and ISO 42001?
Many certification bodies offer combined or integrated audits when the management systems are integrated, but each standard is assessed against its own requirements and each certificate is issued separately. Confirm with your certification body that it is accredited for ISO 42001.
Do I need two Statements of Applicability?
Yes. ISO 27001 and ISO 42001 each require a Statement of Applicability against their own Annex A, with justification for every included or excluded control.
Does ISO 27001 cover AI risk?
Only the information security part of it. Bias, impact on individuals and society, transparency to users and AI lifecycle decisions are ISO 42001 topics that ISO 27001 does not address.
Should we implement ISO 42001 before or after ISO 27001?
Either order works. If customers already ask for ISO 27001, an existing ISMS gives ISO 42001 a ready management-system base; if AI governance is the main buyer question, ISO 42001 can be implemented on its own.
References
This article does not replace the published standards or an independent assessment.
