Reference

ISO/IEC 42001 and ISO/IEC 27001: what transfers and what does not

If you already run a certified information security management system, you are the easiest case for AI governance — and the most likely to overestimate how much carries over. This page separates the two.

Written by Yosef Dabbit, Annexwright · Published 2026-09-23 · Last reviewed 2026-09-23 · Edition 2026.1

The part that transfers

Both standards are written on the same management-system skeleton: context and interested parties, leadership and policy, planning and objectives, support and competence, operation, performance evaluation, improvement. If you already operate that machinery for information security — an internal audit programme, a management review cycle, a nonconformity and corrective action process, a document control approach, a competence plan — the machinery itself does not need rebuilding. It needs a second subject.

Practically, that usually means: your existing audit programme gains an AI scope; your management review agenda gains AI items; your risk process gains a second register with different failure modes; your document set gains AI-specific policies that reference the ones you already have.

The part that does not

The control set is where the two standards genuinely diverge, because the risks are different in kind rather than in degree. Information security controls are largely about confidentiality, integrity and availability. AI controls are about whether a system should exist, what it was trained on, who it affects, whether a human can intervene, and whether the people affected were told.

Impact on peopleAn impact assessment asking who is affected, what harm is possible and what mitigations apply. Information security risk assessment does not ask this.

Data provenanceWhere training and input data came from, on what basis it may be used, and how quality is judged — a different question from classification and access control.

Human oversightWhether a person can review, override or stop an output, and whether that person has the information and authority to do it meaningfully.

Transparency and intended useDisclosing AI use, marking generated content where required, and controlling the purposes a system may be used for.

There is also a scope trap. Your ISO 27001 asset inventory almost certainly does not contain the AI systems you now have to govern: features switched on inside existing SaaS tools, a model called through an API by one team, an assistant inside a support workflow. Those are rarely assets in the 27001 sense and are exactly what an AI inventory must capture.

See the mapping yourself

Rather than asking you to take a summary on trust, the clause-by-clause mapping is published in full and free: the four-way crosswalk sets ISO/IEC 42001 against NIST AI RMF, the EU AI Act and ISO/IEC 27001 in one workbook. It is a complete file from the paid set, not an extract, and it is the fastest way to see what your existing management system already covers.

Take the crosswalk free

ISO/IEC 42001 mapped to NIST AI RMF, the EU AI Act and ISO/IEC 27001, clause by clause, as an Excel workbook. A complete file from the paid set. No signup, no email gate.

Read the crosswalk Download the workbook

A sensible sequence if you hold ISO 27001

Build the AI system inventory first, deliberately scoped to catch embedded and third-party AI.
Run the crosswalk against your existing controls to identify what genuinely carries over.
Add the AI-specific layer — impact assessment, data governance for AI, human oversight, transparency.
Extend your existing audit programme and management review rather than creating parallel ones.
Produce the Statement of Applicability for the AI control set, with a justification against each control.

Steps 3 and 5 are where Professional does the drafting work: the AIMS manual, the Statement of Applicability across 38 Annex A control rows, the gap assessment workbook and the audit evidence binder.

Professional — $397

The ISO/IEC 42001 documentation layer, built to sit on top of a management system you already run.

See what is in Professional How the gap assessment works

What you still do. Annexwright supplies the documentation architecture. You decide which systems are in scope, who owns them, what your risk appetite is and what you will actually do; you fill the registers, adapt the wording, operate the controls and keep the records. Buying documentation does not make an organization compliant or certified.

A note on the standards themselves. ISO/IEC 42001:2023 and ISO/IEC 27001:2022 are copyrighted documents sold by ISO and national standards bodies. This page describes their structure and relationship in our own words and does not reproduce their text. Our Statement of Applicability workbook carries 38 Annex A control rows with summarised purposes; you need a licensed copy of the standard for the normative wording. Annexwright is not affiliated with, endorsed by or accredited by ISO, IEC or any certification body.