ISO 42001 vs ISO 27001: Combining an AIMS and an ISMS Correctly

ISO 42001 (AIMS, AI management system) and ISO 27001 (ISMS, information security) share the Annex SL structure and can be operated in an integrated manner. ISO 27001 protects information, ISO 42001 governs AI risks. Organizations that already have an ISMS extend its scope to cover AI and add the AI-specific Annex A controls, including an AI impact assessment. Both standards build on the same ten-clause framework and can be run within a single program.

• Shared foundation: Both standards follow the harmonized structure of Annex SL. All clauses from 4 (context) to 10 (improvement) share the same numbers and titles and can be audited jointly.
• Different focus: ISO 27001:2022 covers information security with 93 Annex A controls; ISO 42001 covers AI governance with 9 domains and 38 controls, including bias, fairness, explainability and lifecycle.
• The 42001 plus: Only ISO 42001 requires an AI impact assessment (clause 6.1.4) for impacts on individuals, groups and society. ISO 27001 has no counterpart for this.

Why the two standards fit together so well

ISO/IEC 42001:2023 was published in December 2023 as the world's first certifiable management system standard for artificial intelligence. ISO/IEC 27001:2022 is the established standard for information security management systems. Both belong to the family of modern ISO management system standards and therefore follow the same harmonized structure of Annex SL that also underpins ISO 9001 (quality), ISO 14001 (environment), ISO 45001 (occupational health and safety) and ISO 22301 (business continuity).

This shared structure is the decisive lever. The ten-clause skeleton is deliberately compatible with combined and integrated management system audits. In concrete terms, organizations operating ISO 27001 have already built the engine room of a management system: leadership commitment, a risk-based approach, documented information, internal audit, management review and continual improvement. ISO 42001 builds on this and adds the AI-specific content, according to the table of contents of the standard mainly in two clauses. Clause 6 sets out how AI risks are assessed and treated (6.1.2 and 6.1.3) and how the AI system impact assessment works (6.1.4). Clause 6.1.3 also produces the statement of applicability, which determines which Annex A controls apply. Clause 8 requires these processes to be carried out in operation (8.2 to 8.4). Clause 5.2 also calls for a dedicated AI policy.

The audit rhythm is also identical: an ISO 42001 certificate is valid for three years, with annual surveillance audits and a recertification audit at the end of the cycle. That is exactly the same cadence as ISO 27001, which considerably simplifies joint audit planning.

What overlaps and what does not

The overlap lies in the shared clause framework (clauses 4 to 10). The differences sit in the Annex A part and in the AI-specific additions to clauses 6 and 8, above all the AI impact assessment.

Jointly auditable:

• Clauses 4 to 10 with the same numbers and titles: context, leadership, planning, support, operation, performance evaluation, improvement
• Documented information, internal audit, management review: usually integrated
• Risk-based approach: shared, with AI-specific additions

Key differences:

• ISO 27001 Annex A comprises 93 controls (2022 edition) and is focused on information security; ISO 42001 Annex A comprises 38 controls across 9 domains and is focused on AI governance, with additions on bias, fairness, explainability, lifecycle and impact assessment.
• ISO 42001 explicitly requires an AI impact assessment (clause 6.1.4). ISO 27001 has no equivalent for this.

Aspect comparison: ISO 27001 vs ISO 42001

The table shows the pattern: shared framework, different content. Article 15 of the EU AI Act requires high-risk AI systems to achieve accuracy, robustness and cybersecurity. For cybersecurity, an ISMS under ISO 27001 provides the foundation. AI-specific attacks such as data poisoning or manipulated inputs, which Article 15 names explicitly, are not specifically addressed by ISO 27001, and the robustness of the model itself needs its own measures. ISO 42001 contributes the AI-specific governance, fairness and impact assessment topics. The two standards complement one another without replacing each other.

The integrated management system in practice

For organizations with a mature ISO 27001, the following pattern makes sense: internal audit, management review, training and awareness, document control and supplier management are consolidated. The ISMS scope is extended to cover AI, and the AI-specific Annex A controls are added. Combined external audits are offered by all major certification bodies.

Organizationally, this is also reflected in the roles: ISO 42001 does not prescribe a single title such as "AI Officer", yet in practice an AI Officer or AIMS manager is appointed. In mid-sized DACH organizations, this person often also serves as CISO or data protection officer. This creates a continuous line of responsibility between the ISMS and the AIMS. At group level, the AI Officer is often combined with the CISO or CDO, with explicit accountability to a board AI committee.

This article is not legal advice. Specific interpretations of standards, deadlines and articles, particularly in their interplay with the GDPR and the EU AI Act, belong in the hands of qualified advisers and the responsible certification body.

A concrete example: a group with an existing ISMS

A typical case: a DACH group with 2,000 or more employees that already has ISO 27001:2022 in place, often supplemented by ISO 27701 (PIMS). Here, the economics almost always favor integration:

• Shared audit planning: Stage 1 and Stage 2 for ISO 42001 run together with the next ISO 27001 surveillance or recertification audit, where the certification body supports this; a shared internal audit cycle.
• Shared document layer: Policies cascaded from the group, supplemented by AI-specific procedures per business unit.
• Integrated risk register: The AI risk register is hooked into enterprise risk management as a sub-register or tag.
• Saving: In an integrated audit, the certification body may cut audit time by no more than 20 percent compared with the sum of the individual audits, according to IAF MD 11.

The following figures are rough estimates, not survey data (as of 2026, DACH): a group with a mature ISMS should expect around EUR 200,000 to 500,000 for the ISO 42001 program (consulting plus audit plus internal effort), with a duration of 12 to 18 months. A mid-sized deployer without a pre-existing system is more likely to spend EUR 50,000 to 150,000. The time needed depends mainly on the existing system: around 6 to 12 months to Stage 1 with ISO 27001 or ISO 9001 already in place, and 9 to 18 months without one.

In numerical terms, for a group: if the ISO 42001 Stage 2 audit and the upcoming ISO 27001 recertification audit each involve around 10 audit days when run separately, the integrated audit may save at most 4 of the 20 days. How much it actually saves is set by the certification body, based among other things on the level of integration. The same cap applies to the shorter annual surveillance audits, where the saving in days is correspondingly smaller.

When both make sense and when they do not

The combination makes sense when AI systems work with personal or safety-critical data and an ISMS already exists or is planned anyway. In that case, the AIMS and ISMS share their foundation, audit cycle and personnel. It is equally worthwhile for AI providers, who often already hold ISO 27001 and SOC 2 Type II and are pursuing ISO 42001 as a market differentiator. For these providers, combined audits, shared evidence and a common trust center come together.

Caution is warranted when the sole motivation is "completeness": a pure deployer should not preemptively mark all lifecycle controls (Annex A.6) as applicable if it cannot demonstrate them. The audit will expose this, because every control marked as applicable requires evidence. The scope is what counts, not the desire for as many certificates as possible.

For agencies and B2B decision-makers

For marketing agencies and B2B service providers that operate AI-supported processes for clients, the combination of AIMS plus ISMS is increasingly becoming a trust signal in supplier due diligence. Organizations that already hold ISO 27001 have already built the most expensive piece and can set up ISO 42001 with manageable additional effort. Blck Alpaca builds AI agents and automations to fit into an existing ISMS or AIMS: documented, logged and with evidence for the relevant Annex A controls, such as system documentation and event logs. Get in touch if you want to introduce AI systems that do not weaken your management system in the audit.