ISO 42001 or ISO 27001? What AI companies should do first
Enterprise buyers now ask how your AI is governed, not just how your data is secured. How ISO 42001 and ISO 27001 fit together, and which to start with.
By Cyber Ally ·
A year ago, the security review from an enterprise customer asked about encryption, access control and incident response. Today it also asks which AI models you use, what data goes into them, and what your AI agents are allowed to do on their own.
That second set of questions is what ISO 42001 answers. If you build or use AI, you will probably need it, and you will almost certainly need ISO 27001 too. The question is the order.
What ISO 42001 actually covers
ISO/IEC 42001:2023 sets out the requirements for an AI Management System (AIMS). Published in December 2023, it was the first certifiable international standard for AI management. It covers organisations that develop, provide or use AI systems, so it applies even if you never train a model of your own.
At its core, it asks you to:
- Know where AI is used. An inventory of the AI systems in scope, and your role for each one.
- Assess risk. A documented method for identifying and treating AI risks, from training data to deployment.
- Assess impact. An AI system impact assessment for how each system could affect individuals, groups and society.
- Set controls. Annex A controls covering policy, data, the AI lifecycle, third parties and responsible use, with a Statement of Applicability.
- Check and improve. Internal audit, management review and corrective action, just like any other ISO management system.
How it relates to ISO 27001
ISO 42001 and ISO 27001 share the same management system structure: context, leadership, planning, support, operation, performance evaluation and improvement. Many of the building blocks are the same, including risk methodology, document control, internal audit and management review.
What differs is the subject. ISO 27001 protects the confidentiality, integrity and availability of information. ISO 42001 governs how AI is designed, deployed and used responsibly. An AI agent that leaks customer data is an ISO 27001 problem. An AI agent that makes an unfair or unexplainable decision about a customer is an ISO 42001 problem. In practice, most real incidents involve both.
Which comes first
Start with ISO 27001 if your buyers mainly ask for security assurance, or you have no certified management system yet. It is still the certificate most enterprise procurement teams look for first, and the foundations it builds carry straight into ISO 42001.
Start with ISO 42001, or run both together, if AI is the product. If your customers’ questions are about models, agents and training data more than firewalls, ISO 42001 speaks directly to them. Running both as one integrated program avoids building the same risk process, internal audit and management review twice.
Add ISO 42001 next if you already hold ISO 27001 and are shipping AI features or agents. Much of the management system is already in place. The new work is the AI inventory, the AI risk and impact assessments, and the controls specific to AI.
Where AI agents change the picture
Agents are what make this urgent. A chatbot that answers questions is one thing. An agent that reads your CRM, sends emails, changes records and calls other systems is effectively a new member of staff with broad access and no judgement of its own.
Before an auditor or a customer asks, you should be able to answer:
- What can each agent access, and is that the minimum it needs?
- Which actions can it take on its own, and which need a human to approve?
- How do you know what it did, and could you undo it?
- Who owns it, and who reviews its behaviour?
These are governance questions as much as technical ones, and they map cleanly onto both standards.
Our experience
We have taken multiple clients through ISO 42001 certification, and we use AI across our own practice. The pattern is consistent: the companies that move fastest treat AI governance as part of one security program, not a separate project with its own policies and its own audit.
If your customers are starting to ask how your AI is governed, talk to us. We will tell you honestly whether ISO 42001, ISO 27001 or both belong on your roadmap, and in what order. You can also read more about our AI governance service and ISO 42001.