To reuse ISO 27001 controls for ISO 42001, begin with your established governance processes, then expand their scope to cover AI-specific risks and decisions. Documentation, audit and review workflows may carry over; AI impact assessment, data provenance, model evaluation and human oversight need evidence of their own.
An organisation with an established information security management system has useful foundations for AI governance. It already has ways to assign responsibilities, approve documents, review risks and track corrective actions.
However, an AI management system needs to address the organisation's AI activities and their associated risks. ISO 42001 is the management-system standard for that purpose. It should not be reduced to a renamed security policy. ISO 42001 overview.
Begin with governance processes rather than an assumed percentage of overlapping controls. Document control, training administration, internal reporting and action tracking may already work well. Assess whether they can accommodate AI-specific responsibilities and decisions.
Reusing a process should reduce administrative duplication while preserving the additional questions that AI introduces.
| Control area | ISO 27001 | ISO 42001 | Reusable? |
|---|---|---|---|
| Management system (clauses 4–10) | ISMS context, leadership and improvement | AIMS context, leadership and improvement | Partly - extend for AI |
| Risk assessment | Information security risks | AI risks and opportunities | Partly - extend for AI |
| Policies | Information security policy | AI policy and objectives | Partly - extend for AI |
| Supplier management | Security of supplier relationships | AI supplier and third-party dependencies | Partly - extend for AI |
| Incident management | Security incident handling | AI harms and system failures | Partly - extend for AI |
| Internal audit & management review | ISMS audit and review process | AIMS audit and review scope | Partly - extend for AI |
| Documentation control | Controlled ISMS records | Controlled AIMS records | Yes |
| Competence/awareness | Security skills and awareness | AI roles and competence | Partly - extend for AI |
| AI impact assessment | No equivalent AI impact requirement | Assess impacts of AI systems | No - new |
| AI system lifecycle | Secure development and change | AI design, evaluation and monitoring | Partly - extend for AI |
| Data for AI systems | Information asset protection | AI data quality, provenance and use | Partly - extend for AI |
For an AI-supported decision, ask who may be affected, how outputs are used, what limitations are known and when a human should intervene. Those questions sit alongside security concerns about access, confidentiality and resilience.
A system can be securely hosted yet unsuitable for a particular intended use. Conversely, a well-documented oversight policy will not resolve weak access management. Both sets of questions need owners.
Consider a significant model change. Your existing change process can record authorisation and deployment. The AI governance work can add the relevant evaluation, limitations, intended-use review and monitoring decision.
Link those records rather than keeping separate folders that tell conflicting stories. The person approving the change should understand what has changed and which unresolved risks remain.
Choose one AI system and follow it from approval through deployment, monitoring and retirement. Record which steps already work and which require new information or authority. Use the result to design a proportionate rollout for other systems.
Avoid publishing claims about certification or legal compliance simply because a control map exists. Implementation, independent certification and legal analysis answer different questions.
An ISO 42001 readiness assessment should identify the AI scope, usable existing processes, missing governance and the work required from each team. That is more actionable than a long list of documents with no connection to how systems are managed.
Explore ProtectifyAI's ISO 42001 consultancy and the EU AI Act role-mapping guide to connect management-system work with system-specific regulatory assessment.
Related reading: Do AI startups need ISO 42001?, what changes between ISO 42001 and ISO 27001, and how to build one ISO 42001 and EU AI Act governance system.
Yes. The standards share the ISO management-system structure, so an existing ISMS can provide reusable governance, risk, audit and improvement processes.
No. ISO 42001 adds AI-specific requirements for system inventories, impact and risk assessment, data and model governance, human oversight and lifecycle controls.
Use one integrated management-system backbone, then map AI-specific risks, responsibilities, evidence and review points without assuming overlapping controls are identical.
Reuse document control and the processes for leadership review, internal audit, supplier review and corrective action where they fit. Extend their scope and risk criteria for AI; add AI impact assessment, model evaluation, data provenance and human oversight rather than treating security evidence as a substitute.
We'll identify what your existing ISMS already covers and where AI-specific governance still needs work.
Book a working session →