Already on ISO 27001? Adding ISO 42001 in the Same Audit Cycle

If your organisation already operates an ISO/IEC 27001-certified Information Security Management System (ISMS), adding ISO/IEC 42001 doesn't necessarily mean building a second management system from scratch.

You already have useful governance infrastructure: risk-management processes, documented information, internal audit, management review, corrective action, competence programs, and established ownership.

But ISO 27001 does not automatically give you an Artificial Intelligence Management System (AIMS). ISO 42001 introduces AI-specific scope, risks, impacts, responsibilities, controls, dependencies, monitoring, and evidence that need to be addressed on their own terms.

The practical question, then, is not whether the standards "overlap." It is what you can reuse, what you need to adapt, what you must build, and whether the resulting certification activities can realistically be coordinated within the same audit cycle.

» Ready to become ISO compliant? Contact us to find out how we can help

Can ISO 27001 and ISO 42001 be handled in the same audit cycle?

Potentially, yes. An organization can coordinate ISO 27001 and ISO 42001 management-system activities and, when conditions allow, plan an integrated or aligned external audit.

There are two different decisions here.

Integrated implementation means running compatible management-system processes together. For example, you might use one controlled document-management process, one corrective-action workflow, or one management-review structure while ensuring that each standard's specific requirements are addressed.

Integrated auditing means a certification body coordinates assessment against more than one management system standard. The International Accreditation Forum's IAF MD 11:2023 sets requirements for certification bodies auditing integrated management systems against multiple sets of audit criteria.

That does not mean one ISO 27001 surveillance or recertification audit automatically becomes an ISO 42001 certification audit.

ISO 27001 and ISO 42001 remain separate certifiable standards. ISO 42001 certification also requires the certification body to have the appropriate capability to assess an AIMS; ISO/IEC 42006:2025 adds AI-specific requirements for bodies that audit and certify management systems against ISO/IEC 42001.

In practical terms, "same audit cycle" might mean coordinating:

• Certification planning and scheduling
• Shared management-system interviews
• Evidence collection
• Internal audit preparation
• Management review
• Corrective-action work
• External audit activity where the certification body can legitimately integrate it

Whether this works depends less on the calendar and more on whether the AIMS is actually ready.

What can you reuse from an existing ISO 27001 program?

The biggest opportunity is usually to reuse the management-system machinery, not to assume that ISO 27001 controls automatically satisfy ISO 42001.

Both standards follow ISO's management-system approach, making it possible to build AI governance on processes an organization may already operate successfully.

Governance and documented processes

An established ISMS probably already has defined ownership, policy management, document control, approval processes, objectives, and governance routines.

Those processes can provide a useful foundation for the AIMS.

For example, you do not necessarily need a completely separate document-control mechanism for AI governance. You may be able to use the same process to approve, review, version, and retain AIMS documentation.

But reuse the process, not necessarily the content.

An information security policy does not become an AI policy simply because both standards use management-system concepts. You still need to define the AI-specific objectives, responsibilities, scope, and decisions.

Risk-management machinery

ISO 27001 organizations already have a method for assessing and treating information security risk.

That can be valuable when implementing ISO 42001 because the organization is accustomed to concepts such as identifying risks, assigning ownership, evaluating treatment options, documenting decisions, and reviewing risk over time.

The mistake would be assuming that the existing ISMS risk register is enough.

AI introduces additional questions that a traditional information security assessment may not capture. Depending on the system and context, those may include reliability, data quality, transparency, human oversight, misuse, AI-specific supplier dependencies, or impacts on affected people and organizations.

The existing risk-management process may therefore be reusable. The AI-specific analysis and outputs are not automatically covered.

Internal audit, management review, and corrective action

These are strong candidates for coordination.

If your organization already has an internal audit program, management-review meetings, and a corrective-action workflow, it may not make sense to create parallel administrative processes solely because you added ISO 42001.

Instead, the existing program can potentially be expanded to include:

• AIMS audit criteria and scope
• AI-related performance information
• Relevant risks and opportunities
• AIMS findings and nonconformities
• AI-specific corrective actions
• Management decisions affecting the AIMS

You can share the underlying process, while keeping the evidence and criteria appropriate to each standard.

Competence, awareness, and supplier governance

A similar principle applies to competence and third-party management.

Your ISMS may already define how you identify training needs, evaluate competence, and assess suppliers. You can extend those mechanisms to cover AI-specific responsibilities.

For example, a security supplier review may already assess access control, data protection, incident response, and contractual safeguards. If the supplier also provides an AI model, API, or platform, the review may need additional criteria addressing the AI dependency itself.

The process is familiar. The subject matter changes.

ISO 27001

GRSee makes ISO 27001 simple and effective.

Expert-Led: ISO auditors paired with cybersecurity specialists.

Reduce Risk: Identify and fix vulnerabilities.

Build Trust: Show commitment to protecting client data.

Contact us

What new work does ISO 42001 add?

An ISO 27001-certified organization has a head start, but ISO 42001 applies the management-system model to a different problem: how the organization develops, provides, integrates, or uses AI.

That creates work an ISMS does not automatically provide.

AI inventory, role, and AIMS scope

You need sufficient visibility into the AI systems and use cases the organization is responsible for.

That could include internally developed AI functionality, third-party models integrated into products, AI-enabled SaaS tools, internal generative AI use, or external AI services supporting business processes.

You also need to understand the organization's role relative to those systems.

A SaaS provider building AI functionality has different responsibilities from a company using a commercial AI assistant internally. A business integrating a third-party model into its own customer-facing product sits somewhere else again.

That analysis feeds directly into AIMS scope.

The AIMS and ISMS scopes do not have to be identical. An enterprise-wide ISMS could coexist with an AIMS focused on a particular product, business unit, or set of AI systems. But the further the scopes diverge, the more carefully you need to plan integration and audit coordination.

AI-specific risk and impact work

An existing ISO 27001 risk process can provide structure, but the AIMS requires the organization to address AI-related risk in its own context.

ISO 42001 also contains specific requirements concerning AI system impact assessment. That work should not be collapsed into the ISMS simply because the organization already has a security risk methodology.

The practical objective is to ask what could happen because of the AI system, who or what may be affected, and whether the organization has appropriate treatment and governance in place.

For one system, confidentiality and access control may dominate. For another, reliability, human oversight, transparency, or the consequences of inaccurate output may matter more.

AI lifecycle, suppliers, and controls

AI also changes the dependency model.

A production AI feature may rely on an external model provider, cloud AI service, model API, dataset, orchestration component, or other external service. You need to understand those relationships in the context of the AIMS.

Some existing ISO 27001 controls may still matter. Access control, supplier security, incident management, secure development, logging, and change management still matter because AI is involved.

But information security controls alone do not equal an AI governance program.

The organization still needs to determine which controls are appropriate for its AIMS, based on its role, scope, risks, impacts, objectives, and applicable ISO 42001 requirements.

AI performance, monitoring, and evidence

An operating AIMS also needs evidence.

Existing ISMS evidence-management practices may make this easier, but the artifacts will often differ. Depending on the system and processes in scope, the organization may need evidence of AI inventories, risk decisions, impact assessments, approval processes, supplier reviews, monitoring, changes, governance reviews, or corrective actions.

The exact evidence depends on the requirements and implementation.

The important principle is that an auditor should be able to see how AI governance operates in normal business activity, not only how it is described in policy.

When does aligning the two audit cycles make sense?

Audit-cycle alignment makes sense when the AIMS is ready enough to be audited, and there is enough operational overlap to make coordination useful. Before choosing the next ISO 27001 surveillance or recertification window as the ISO 42001 target, check five things.

Is the AIMS actually operating?

Do not let an attractive audit date force an immature AI governance program into certification. You need implemented processes and enough evidence to demonstrate that they operate.

How closely do the scopes align?

Compare business units, products, locations, systems, technologies, interested parties, and ownership. Shared scope makes coordination easier; different scope does not prevent it, but it changes the audit plan.

Is the AI-specific evidence ready?

An established ISMS may have years of operating evidence. A newly implemented AIMS may not. Audit coordination should reflect that difference.

Where are you in the ISO 27001 certification cycle?

An upcoming surveillance or recertification activity may create an opportunity to align interviews, preparation, management-system review, and external audit scheduling.

Can the certification body support the combined plan?

Discuss ISO 42001 early with the certification body. Confirm its ability to provide the required certification activity and how it would plan an integrated or coordinated audit.

The objective is to remove unnecessary duplication. It is not to reduce the assessment depth required by either standard.

ISO 27001 to ISO 42001: What should you reuse, adapt, or build new?

A useful starting point is to classify your existing ISMS capabilities into three groups: reuse, adapt, or build.

This is not an official ISO mapping. It is an implementation-planning model.

The value is in asking the right question for each process: “Do we already have something that works, does it need AI-specific adaptation, or is this genuinely new?”

That produces a much more useful implementation plan than treating ISO 42001 as either a completely separate project or a minor extension of ISO 27001.

Add ISO 42001 without rebuilding your ISO program from scratch

If you already operate ISO 27001, the right starting point for ISO 42001 is not a blank page. It is a structured review of what your ISMS already does well, what needs to be extended for AI, and which AIMS requirements create genuinely new work.

GRSee supports both ISO 27001 and ISO 42001 programs, including gap assessment, implementation planning, internal audit and certification-readiness work. Where the standards can be coordinated, our OneAudit approach can also help structure shared scope, evidence, interviews, and preparation without treating separate requirements as interchangeable.

The goal is a single practical roadmap: reuse what already works, close the AI-specific gaps, and coordinate audit work where it's technically and operationally sound.

» If you already have ISO 27001, GRSee can review your existing ISMS against ISO 42001 and help determine whether your next audit cycle is a practical point to add AI management system certification.

Comprehensive ISO Certification Support

Reach ISO compliance with the expert guidance of GRSee.

Gap analysis and risk assessment

Customized policy updates and integration

Continuous staff training and compliance oversight

Contact Us