AI systems introduce governance challenges that traditional information security processes may not fully address. A company can have an established Information Security Management System (ISMS), documented security controls, and an internal audit programme while still lacking processes for AI system impact assessments, model governance, and AI-specific risk management.
This is where ISO/IEC 42001:2023 becomes relevant.
ISO 27001 focuses on information security management, whereas ISO 42001 specifies requirements for establishing and continually improving an Artificial Intelligence Management System (AIMS). For engineering teams that already work with ISO 27001, the transition can involve reusing suitable management processes and extending them to cover AI-specific requirements.
The important part is understanding what can be reused, what needs to be added, and how to maintain evidence as AI systems evolve.
Why Does ISO 27001 Alone Not Cover Every AI Governance Requirement?
Information security remains an essential part of AI governance, but it is not the only concern.
Consider an application that uses a third-party language model to process customer requests. The engineering team may already assess access controls, encryption, data confidentiality, and supplier security under its ISMS.
However, additional questions may arise:
- Can the model produce biased or inappropriate outputs?
- Are the training or input data suitable for the intended purpose?
- When should a human review an AI-generated decision?
- How are changes to the model evaluated before deployment?
- What documentation is needed to explain the system's behaviour and limitations?
- How are AI-related risks monitored after release?
These questions require processes that address AI systems and their lifecycle, rather than information security alone.
ISO 42001 provides a management-system framework for organising this work.
What Can Engineering Teams Reuse From ISO 27001?
ISO 27001 and ISO 42001 share the same general harmonized management-system structure across clauses 4 to 10. This creates opportunities to coordinate activities instead of maintaining two completely separate management systems.
1. Risk management workflows
An existing risk register can provide a useful starting point for AI governance.
For example, an engineering team may already document security risks, assign owners, define mitigation measures, and review outstanding issues. These practices can support the AIMS, provided the risk methodology is extended to address relevant AI-related risks and opportunities.
AI-specific assessments may need to consider bias, explainability, data quality, human oversight, and potential impacts on people.
2. Document control and evidence
Many organisations already use version-controlled repositories, ticketing systems, approval workflows, and audit records.
These systems may help maintain AI policies, risk assessments, technical documentation, review decisions, and corrective actions.
The objective is not to create a separate document for every standard. It is to maintain reliable records that can be traced to the requirements they support.
3. Internal audits and management reviews
Existing audit schedules and management review processes may also be coordinated.
However, audit criteria must cover the requirements of both standards. An ISMS audit that focuses only on information security does not automatically establish that an AIMS is effective.
For more detail on shared processes and standard-specific requirements, see the ISO 27001 and ISO 42001 integration guide.
A Practical ISO 42001 Implementation Workflow
A phased approach can help technical teams identify gaps and introduce AI governance without unnecessarily duplicating existing work.
Step 1: Inventory your AI systems
Start by identifying the AI systems used, developed, provided, or deployed within the proposed AIMS scope.
Depending on your organisation, the inventory may include:
- Internally developed machine learning models
- Third-party language models and APIs
- AI-enabled SaaS products
- Retrieval-augmented generation applications
- Automated decision-support systems
- AI components integrated into production services
For each system, record its intended purpose, owner, deployment environment, relevant data sources, external dependencies, and lifecycle status.
This inventory creates a shared reference point for risk assessments, governance decisions, and change management.
Step 2: Define the AIMS scope and responsibilities
Determine which organisational activities and AI systems fall within the management system.
Assign responsibilities across engineering, security, product management, legal, and compliance teams as appropriate.
For example, an ML engineer might maintain model documentation, a security engineer might assess technical vulnerabilities, and a product owner might coordinate reviews of intended use and operational changes.
These are possible organisational arrangements, not job titles mandated by ISO 42001.
Step 3: Perform an AI-specific gap analysis
Compare your current management processes with the requirements of ISO 42001.
Review areas such as:
- AI policy and governance responsibilities
- AI risk assessment and treatment
- AI system impact assessment
- AI objectives and performance evaluation
- Data and AI lifecycle management
- Human oversight and relevant transparency processes
- Third-party AI relationships
- Internal audit and continual improvement
Record each gap, the required action, its owner, and the evidence needed to demonstrate implementation.
An existing ISO 27001 certification does not automatically satisfy ISO 42001 requirements.
Teams planning this transition can use the ISO 42001 implementation guide for ISO 27001 holders as a reference for organising implementation phases and identifying areas that require additional work.
Step 4: Assess AI risks and impacts
Risk assessment should reflect the context and intended use of each AI system.
For a customer-facing chatbot, the assessment might examine inaccurate responses, inappropriate disclosures, data handling, and the need for human escalation.
For an AI recruitment system, relevant considerations might include potentially discriminatory outcomes, data representativeness, explainability, and human review.
The assessment process should produce documented findings and decisions. These results can inform risk treatment, AI objectives, and the selection of applicable controls.
ISO 42001 addresses AI system impact assessment as well as AI-related risk management. The two activities should not be treated as interchangeable.
Step 5: Map and implement the controls
Annex A of ISO 42001 contains 38 reference controls organised into nine control objectives.
These objectives cover AI policies, internal organisation, resources, AI system impact assessment, the AI system lifecycle, data, information for interested parties, AI system use, and third-party and customer relationships.
Build a control map that identifies the applicable requirements, current processes, gaps, owners, and supporting evidence.
Where an existing security process supports an AI governance objective, document the relationship. Where it does not cover the relevant requirement, introduce an additional control or process.
The mapping should be based on the actual requirements and the organisation's circumstances, rather than assumptions that similarly named controls are equivalent.
Step 6: Integrate governance into the software development lifecycle
For engineering teams, AI governance is easier to maintain when it connects to existing development workflows.
Consider introducing the following practices:
Before deployment: Review intended use, relevant risks, data considerations, and required approvals.
During development: Maintain model and system documentation, track relevant changes, and record assessment results.
Before significant changes: Evaluate whether a model update, new data source, or change in intended purpose requires another risk or impact assessment.
After deployment: Monitor relevant performance indicators, record incidents, and assign corrective actions where necessary.
The exact controls depend on the system, its context, and applicable requirements. ISO 42001 does not prescribe a single CI/CD implementation for every AI application.
Step 7: Audit and improve the management system
Conduct an internal audit against the applicable ISO 42001 requirements and defined audit criteria.
Review the implementation of controls, the quality of evidence, assigned responsibilities, and the operation of risk and impact assessment processes.
Management review should evaluate the suitability, adequacy, and effectiveness of the AIMS. Track findings and corrective actions rather than treating the audit as the final step.
Organisations seeking certification should coordinate with an appropriate certification body.
How Can Teams Manage AI Governance Evidence?
A common operational problem is that evidence becomes scattered across Git repositories, spreadsheets, project management tools, shared drives, and approval systems.
This can make it difficult to determine which AI systems have been assessed, who approved a decision, and whether the supporting documentation is current.
A central evidence structure can help.
For example, an organisation might maintain the following relationships:
- AI system inventory → identifies the system and its owner.
- Risk assessment → records identified risks and treatment decisions.
- Control mapping → connects requirements to implemented processes.
- Technical documentation → describes relevant system characteristics and limitations.
- Approval records → establish who reviewed and authorised a decision.
- Monitoring records → provide evidence of ongoing review and improvement.
These relationships can be maintained in existing tools or supported by dedicated AI governance software.
The objective is traceability: teams should be able to move from an AI system to its relevant assessments, controls, decisions, and evidence without reconstructing the history manually.
Where Does the EU AI Act Fit Into ISO 42001?
ISO 42001 is a voluntary management-system standard, while the EU AI Act establishes legal obligations for relevant AI systems and actors.
An AIMS can support governance processes, documentation, and risk management. However, ISO 42001 certification alone does not establish compliance with the EU AI Act.
Organisations must separately determine their applicable legal obligations, including relevant requirements for high-risk AI systems, transparency, AI literacy, and other provisions where applicable.
The legal roles of provider and deployer also need to be assessed under the EU AI Act. They should not be inferred solely from an organisation's internal governance responsibilities.
For teams coordinating management-system work with regulatory requirements, an integrated approach can reduce duplicated effort while preserving the distinction between voluntary standards and legal obligations.
Can AI Compliance Software Support the Implementation?
AI governance software can help organisations connect AI inventories, risk assessments, control mappings, and evidence records in one workflow.
AnnexOps is one option for teams managing ISO 42001, ISO 27001, and EU AI Act compliance operations. Its ISO 27001 compliance solution describes support for ISMS scope, risk registers, controls, evidence, and internal audits.
Software selection should depend on the organisation's scope, existing tools, evidence requirements, and workflow needs. A platform can support compliance operations, but it does not replace management accountability, legal assessment, or an independent certification audit.
Final Thoughts
Moving from ISO 27001 to ISO 42001 is an extension of management-system capabilities, not simply a change in security documentation.
Engineering and compliance teams can make the transition more manageable by inventorying AI systems, defining responsibilities, assessing AI-specific risks and impacts, mapping controls, and maintaining traceable evidence.
The most sustainable approach is to connect governance activities to the software lifecycle and existing management processes while preserving the requirements unique to each standard.
For a detailed phase-by-phase roadmap, read the ISO 42001 implementation guide for organisations that already have ISO 27001.
Top comments (0)