ISO 42001 or ISO 27001: which do you need, and which first?

Part of the guide ISO 42001 in the UK: who certifies you, and what does it cost?

What is the difference between ISO 27001 and ISO 42001?

ISO 27001 manages risks to the security of information, and ISO 42001 manages how an organisation develops, provides or uses AI. ISO says conformity with ISO 27001 means an organisation has a system to manage risks to the security of the data it owns or handles.

ISO describes an AI management system as the policies, objectives and processes an organisation sets for the responsible development, provision or use of AI systems.

Both are management system standards. ISO says many of its management system standards have the same structure, and share many terms, definitions and requirements.

If you have ISO 27001, do you need ISO 42001?

If you have ISO 27001, you need ISO 42001 only when a customer, a tender or your own plans call for it. Both are standards, not laws. A request for ISO 42001 is a request for a certificate to that standard, and an ISO 27001 certificate does not meet it.

ISO says ISO 42001 does not look at the details of specific AI applications. It gives a way to manage AI risks and opportunities across an organisation. ISO 27001 manages risks to the security of information, which is a different job.

Accreditation is separate too. A certification body does not need to offer every type of management system certification, so check its accreditation for each standard.

ISO 27001 or ISO 42001: which should you do first?

Start with the standard that a customer or a tender asks for. If you are asked for both, the shared structure means much of the work on one also serves the other.

ISO publishes a practical guide for organisations that use more than one management system standard and want to run them as one integrated system.

Allow time before the first audit. For ISO 42001, NQA, one of the five UKAS accredited bodies, says your system must have run for at least three months, with a management review and a full cycle of internal audits.

Can one certification body audit both standards?

One certification body can audit both standards if its UKAS schedule lists both. All five UK bodies that UKAS accredits for ISO/IEC 42001 also list ISO/IEC 27001:2022: BSI Assurance UK, ISOQAR, LRQA, NQA and TÜV UK.

Check the schedule for each standard you want, because accreditation for one does not carry across to the other. For either standard, the body that certifies you may not also help you prepare.

Our guide to ISO 42001 certification lists the five bodies, and our ISO 27001 guide explains how to check a body for ISO 27001.

What to do

1. Ask the customer or the tender which certificate it wants, and whether it must be UKAS accredited.
2. If you hold ISO 27001 and now need ISO 42001, check whether your certification body's UKAS schedule lists ISO/IEC 42001.
3. If you need both, plan them as one management system, and ask your certification body how it audits the two.
4. Keep the firm that helps you prepare separate from the body that certifies you.

Common questions

Does ISO 27001 cover AI?

ISO 27001 covers information security management. How you develop, provide or use AI is the job of a separate standard, ISO/IEC 42001.

Is either standard a legal requirement in the UK?

No. Both are standards, and certifying is a choice. A contract or a tender can still make one a condition. For the laws that do cover AI in the UK, see how the UK regulates AI.

Where next

• Seeking ISO 42001 certification
• What does ISO 27001 certification take, and who can certify you?
• Does your UK business need an AI policy, and what goes in it?

This is an independent editorial guide, not legal advice.