Is it worth investing in ISO 42001 if you already have ISO 27001?

If your organisation holds ISO 27001 certification, you've probably already asked this question since AI governance started showing up in conversations. You've already invested time and budget building an Information Security Management System (ISMS). So, do you really need another standard?

The short answer is that the two standards are designed to complement each other. There’s overlap between some of the controls, but they cover different ground.  

If you already have ISO 27001, you're in a stronger position than most to take on ISO 42001 and much of the groundwork is already done. So, the solution could be simpler than you think.  

If you need help deciding whether ISO 42001 is the right move, keep reading, or download our AI Governance brochure.

Where the two standards overlap

ISO 27001 and ISO 42001 share the same high-level structure; the framework ISO uses across its management system standards. According to our consultants, around 40% of ISO 42001 is already covered by ISO 27001.

Most of that overlap sits in the core clauses rather than the technical controls. The requirements around context of the organisation, leadership, planning, support, operation, performance evaluation and improvement follow the same pattern in both standards.  

In practice, many of the processes you already run for ISO 27001 can be extended to cover AI rather than built from scratch, including document control, internal audit, management review, competence and awareness, risk management and corrective action.

Your team already knows how to operate a management system; evidence controls and prepare for an external audit. That experience carries straight across.

So far, many organisations have chosen to run the two as an integrated management system rather than two separate ones: One set of governance structures, one audit programme, one management review, covering both information security and AI.

Where ISO 27001 stops short

ISO 27001 is ultimately an information security management system (ISMS). So, while it's an excellent framework for securing the systems and data that AI tools rely on, it wasn’t designed to answer the questions clients are now asking about AI.

ISO 27001 doesn't address whether your AI system's outputs are accurate or fair, who is accountable when an AI tool makes a decision that affects a customer or how AI is governed across its lifecycle.

ISO 42001 now fills those gaps. Its controls cover areas including AI system impact assessments, data used by AI systems, the AI system lifecycle, transparency and information for interested parties, responsible use of AI and third-party AI relationships.

At a basic level, ISO 27001 helps you protect the data going into your AI and ISO 42001 helps you govern what the AI does with it.

How they complement each other

The real value comes from running both concurrently. For example:

Rather than duplicating effort, each standard strengthens the other. And for clients, holding both demonstrates that you've considered not only whether your data is secure, but whether the AI using that data is governed responsibly.

So, is it worth it?

For many organisations with ISO 27001 already in place, the answer is yes, particularly if:

• AI is embedded in products or services you sell to clients.
• Clients or prospects are asking AI governance questions in due diligence or procurement.
• You operate in a regulated sector where AI use is coming under scrutiny
• You want a recognised way to evidence responsible AI use, rather than relying on policy statements.

If you’re not ready for another ISO certification

Not every organisation with ISO 27001 is ready to commit to a second standard straight away and that’s a reasonable position. If AI use is still relatively limited or the business case for certification isn’t there yet, there’s a proportionate middle ground; folding foundational AI governance into the ISMS you already run.

This is where existing ISO 27001 holders have a particular advantage. Foundational AI governance focuses on the areas that deliver the quickest wins: organisational preparedness, risk assessments, supplier due diligence and policies. These are the same clause-level areas where ISO 27001 and ISO 42001 overlap most, so much of the groundwork is already in place.

That means getting visibility of the AI tools in use across the organisation, establishing clear ownership and oversight of AI outputs and documenting controls that sit alongside your existing ISO 27001 processes. It gives you something credible to show clients now, and puts you on a clear path to ISO 42001 when the time is right.

How PGI can help

Our ISO-certified consultants have extensive experience across information assurance, designing and implementing ISMSs, auditing and helping clients achieve and maintain ISO certification.  

If you're looking to integrate AI governance into your existing ISMS without the overhead of a formal framework, our AI Governance Foundations service is the right next step. 

Or, if you’re ready to achieve ISO 42001 certification, we can help you make the most of the work you've already done. 

Download our AI Governance brochure to find out more.

Let’s talk.