# ISO 42001 or ISO 27001: which do you need, and which first?

Picking the right order saves you doing the same work twice.

The Assurance Desk. Published 5 October 2026. Last checked 7 October 2026.

Part of the guide [ISO 42001 in the UK: who certifies you, and what does it cost?](https://theassurancedesk.com/guides/iso-42001-certification-and-who-can-certify-you.md).

**The short answer.** ISO/IEC 27001 is the standard for managing information security. ISO/IEC 42001 is the standard for managing how an organisation develops, provides or uses AI ([ISO, ISO/IEC 27001:2022](https://www.iso.org/standard/27001) and [ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026). So a certificate for one does not stand in for the other. Start with the one a customer or a tender asks for. The two share a structure, so they can run as one management system ([ISO, management system standards](https://www.iso.org/management-system-standards.html), checked 5 October 2026).

## What is the difference between ISO 27001 and ISO 42001?

ISO 27001 manages risks to the security of information, and ISO 42001 manages how an organisation develops, provides or uses AI. ISO says conformity with ISO 27001 means an organisation has a system to manage risks to the security of the data it owns or handles ([ISO, ISO/IEC 27001:2022](https://www.iso.org/standard/27001), checked 5 October 2026).

ISO describes an AI management system as the policies, objectives and processes an organisation sets for the responsible development, provision or use of AI systems ([ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026).

Both are management system standards. ISO says many of its management system standards have the same structure, and share many terms, definitions and requirements ([ISO, management system standards](https://www.iso.org/management-system-standards.html), checked 5 October 2026).

**Two standards, two jobs**

- **ISO/IEC 27001**
  - Manages risks to the security of information
  - Third edition, published October 2022
  - For organisations of any size, in any sector
  - Certified by a body accredited for ISO/IEC 27001
- **ISO/IEC 42001**
  - Manages how an organisation develops, provides or uses AI
  - First edition, published December 2023
  - For organisations of any size that develop, provide or use AI
  - Certified by a body accredited for ISO/IEC 42001

What each standard manages, from ISO's own pages.

Source: ISO, ISO/IEC 27001:2022, https://www.iso.org/standard/27001 (checked 5 October 2026); ISO, ISO/IEC 42001:2023, https://www.iso.org/standard/42001 (checked 5 October 2026)

## If you have ISO 27001, do you need ISO 42001?

If you have ISO 27001, you need ISO 42001 only when a customer, a tender or your own plans call for it. Both are standards, not laws. A request for ISO 42001 is a request for a certificate to that standard, and an ISO 27001 certificate does not meet it.

ISO says ISO 42001 does not look at the details of specific AI applications. It gives a way to manage AI risks and opportunities across an organisation ([ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026). ISO 27001 manages risks to the security of information, which is a different job.

Accreditation is separate too. A certification body does not need to offer every type of management system certification, so check its accreditation for each standard ([ISO, ISO/IEC 17021-1:2015](https://www.iso.org/standard/61651.html), checked 5 October 2026).

## ISO 27001 or ISO 42001: which should you do first?

Start with the standard that a customer or a tender asks for. If you are asked for both, the shared structure means much of the work on one also serves the other ([ISO, management system standards](https://www.iso.org/management-system-standards.html), checked 5 October 2026).

ISO publishes a practical guide for organisations that use more than one management system standard and want to run them as one integrated system ([ISO, Integrated management systems: a practical guide](https://www.iso.org/publication/PUB100435.html), checked 5 October 2026).

Allow time before the first audit. For ISO 42001, NQA, one of the five UKAS accredited bodies, says your system must have run for at least three months, with a management review and a full cycle of internal audits ([NQA, ISO 42001 certification](https://www.nqa.com/en-gb/certification/standards/iso-42001), checked 5 October 2026).

**Choose the standard around the requirement**

| Your starting point | What to do next |
| --- | --- |
| A customer asks for ISO 27001 | Start with its information security requirement |
| A customer asks for ISO 42001 | Start with its AI management requirement |
| You need both | Plan the shared work, then check accreditation for both standards |

Source: ISO, ISO/IEC 27001:2022, Information security management systems, https://www.iso.org/standard/27001 (checked 5 October 2026); ISO, ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system, https://www.iso.org/standard/42001 (checked 5 October 2026); ISO, management system standards, https://www.iso.org/management-system-standards.html (checked 5 October 2026)

## Can one certification body audit both standards?

One certification body can audit both standards if its UKAS schedule lists both. All five UK bodies that UKAS accredits for ISO/IEC 42001 also list ISO/IEC 27001:2022: BSI Assurance UK, ISOQAR, LRQA, NQA and TÜV UK ([UKAS, schedule 0003, BSI Assurance UK Ltd](https://www.ukas.com/download-schedule/0003/ManagementSystems), [UKAS, schedule 0026, ISOQAR Limited](https://www.ukas.com/download-schedule/0026/ManagementSystems), [UKAS, schedule 0001, LRQA Limited](https://www.ukas.com/download-schedule/0001/ManagementSystems), [UKAS, schedule 0015, NQA Certification Ltd](https://www.ukas.com/download-schedule/0015/ManagementSystems), [UKAS, schedule 0065, TUV UK Limited](https://www.ukas.com/download-schedule/0065/ManagementSystems), checked 5 October 2026).

Check the schedule for each standard you want, because accreditation for one does not carry across to the other. For either standard, the body that certifies you may not also help you prepare ([European Accreditation](https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/), checked 5 October 2026).

[Our guide to ISO 42001 certification](/guides/iso-42001-certification-and-who-can-certify-you) lists the five bodies, and [our ISO 27001 guide](/guides/iso-27001-certification-and-who-can-certify-you) explains how to check a body for ISO 27001.

## What to do

1. Ask the customer or the tender which certificate it wants, and whether it must be UKAS accredited.
2. If you hold ISO 27001 and now need ISO 42001, check whether your certification body's UKAS schedule lists ISO/IEC 42001.
3. If you need both, plan them as one management system, and ask your certification body how it audits the two.
4. Keep the firm that helps you prepare separate from the body that certifies you.

## Common questions

### Does ISO 27001 cover AI?

ISO 27001 covers information security management. How you develop, provide or use AI is the job of a separate standard, ISO/IEC 42001 ([ISO, ISO/IEC 27001:2022](https://www.iso.org/standard/27001) and [ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001), checked 5 October 2026).

### Is either standard a legal requirement in the UK?

No. Both are standards, and certifying is a choice. A contract or a tender can still make one a condition. For the laws that do cover AI in the UK, see [how the UK regulates AI](/guides/uk-ai-regulation).

## Where next

- [Seeking ISO 42001 certification](https://theassurancedesk.com/best/certification-seeking.md)
- [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md)
- [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md)

## Sources

- ISO, ISO/IEC 27001:2022, Information security management systems: https://www.iso.org/standard/27001 (checked 5 October 2026)
- ISO, ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system: https://www.iso.org/standard/42001 (checked 5 October 2026)
- ISO, management system standards: https://www.iso.org/management-system-standards.html (checked 5 October 2026)
- ISO, Integrated management systems: a practical guide (IMS PG), third edition, 2026: https://www.iso.org/publication/PUB100435.html (checked 5 October 2026)
- ISO, ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems: https://www.iso.org/standard/61651.html (checked 5 October 2026)
- NQA, ISO 42001 certification: https://www.nqa.com/en-gb/certification/standards/iso-42001 (checked 5 October 2026)
- European Accreditation, FAQ 41.1: impartiality, ISO/IEC 17021-1:2015 clause 5.2.5: https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/ (checked 5 October 2026)
- UKAS, schedule of accreditation 0003, BSI Assurance UK Ltd: https://www.ukas.com/download-schedule/0003/ManagementSystems (checked 5 October 2026)
- UKAS, schedule of accreditation 0026, ISOQAR Limited: https://www.ukas.com/download-schedule/0026/ManagementSystems (checked 5 October 2026)
- UKAS, schedule of accreditation 0001, LRQA Limited: https://www.ukas.com/download-schedule/0001/ManagementSystems (checked 5 October 2026)
- UKAS, schedule of accreditation 0015, NQA Certification Ltd: https://www.ukas.com/download-schedule/0015/ManagementSystems (checked 5 October 2026)
- UKAS, schedule of accreditation 0065, TUV UK Limited: https://www.ukas.com/download-schedule/0065/ManagementSystems (checked 5 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.