ISO/IEC 27001 and ISO/IEC 42001 both use management-system principles, but they address different objectives. ISO 27001 focuses on managing information-security risk. ISO 42001 focuses on the responsible governance, development, provision and use of artificial intelligence.
ISO 27001: Protecting Information
An Information Security Management System defines how an organisation identifies, treats and monitors risks to confidentiality, integrity and availability. Its scope can cover information, technology, people, facilities and suppliers. Typical outputs include risk treatment plans, a Statement of Applicability, security policies and evidence that controls operate.
ISO 42001: Governing AI
An AI Management System establishes accountability for AI and processes for assessing impacts and risks across the AI lifecycle. It considers how AI is developed, procured, used, monitored and retired, as well as relevant data, suppliers, transparency, competence and affected parties.
Where They Overlap
Both standards require context, leadership, risk-based planning, competence, documented information, operational control, performance evaluation and improvement. An AI system may also create information-security risks, so some governance, supplier and incident processes can be coordinated.
The overlap does not make the standards interchangeable. An ISO 27001 system may protect an AI service without fully addressing its wider impacts and governance. An ISO 42001 system may govern AI responsibly without covering the full information-security scope of the organisation.
Choosing the Right Starting Point
Start with the business objective and scope. Organisations handling sensitive information or responding to security-assurance requests may prioritise ISO 27001. Organisations developing or making material use of AI may need ISO 42001. Some technology and financial-services organisations may benefit from an integrated approach.
Certivanta can help map shared processes while keeping standard-specific requirements clear. Independent certification bodies perform the audits and make certification decisions. Compare our ISO 27001 and ISO 42001 services.
A Practical South African Example
A financial-services provider using a third-party AI assistant may need ISO 27001 controls for access, suppliers and incident response, while ISO 42001 addresses intended use, impact, accountability, human oversight and AI lifecycle change. Privacy and sector requirements still need separate evaluation. The two systems can share governance without treating their risks as identical.
Questions Buyers Should Ask
- Is the immediate assurance need about information security, AI governance or both?
- Does the organisation develop AI, provide it or only use it?
- Which suppliers can provide meaningful technical and assurance evidence?
- Can existing risk, audit and management-review processes be integrated?
Cost of an Integrated Approach
Existing ISMS maturity, the number of AI systems, third-party dependencies and required technical assessments determine effort. Integration may reduce duplicated governance, but specialist testing and legal or privacy work remain separate. Compare the ISO 27001 and ISO 42001 service pages or request a scoped discussion.
What a Combined Proposal Should Confirm
The proposal should show which workshops and governance processes can be shared and which assessments remain specific to security or AI. It should name the systems, services and organisational roles in scope, state whether technical testing or legal review is included and explain how internal audit will preserve competence and independence. A combined project should reduce duplication without hiding the evidence each standard requires.