ISO 27001 to ISO 42001: how to extend your ISMS into an AI management system

Can an ISMS be extended into an AIMS?

Yes, and for most organisations that already hold ISO/IEC 27001 it is the sensible route. ISO/IEC 42001:2023 states in its introduction that it applies the harmonised structure, the same clause numbers, titles, core text and common terms that ISO/IEC 27001:2022 uses. Your ISMS therefore already has the machinery an AIMS needs: scope, policies, roles, a risk method, document control, audit, review and corrective action.

What the ISMS does not have is the subject matter. Information security asks whether information stays confidential, intact and available. AI governance asks whether each AI system is developed, provided and used responsibly, and what it could do to the people it touches. The extension adds that question to the machinery you own instead of building a parallel system.

What carries over from ISO/IEC 27001

In practice these usually need widening rather than writing:

• Context and interested parties (clause 4): the issues and interested-party registers gain AI entries; the climate-change question sits in clause 4.1 of both.
• Leadership and roles (clause 5): the role map gains an AIMS lead and an owner per AI system.
• Objectives and planning of changes (clause 6): one objectives register and one change procedure can hold both sets.
• Support (clause 7): document control, competence and awareness extend to AI roles.
• Performance evaluation and improvement (clauses 9 and 10): one audit programme, one review, one corrective action log.

Several information security controls also support AI systems directly: access management for models and training data, logging and monitoring, secure development, supplier security and incident management.

What ISO/IEC 42001 adds that the ISMS never asked for

Scope built on AI systems and roles

An ISMS scope names services, sites and systems. The AIMS scope names AI systems and whether you develop, provide or use each one, because the obligations differ by role. The scope guide covers how to draw the boundary.

An AI policy and AI objectives

Clause 5.2 asks for a separate AI policy that frames the AI objectives and refers, as relevant, to your other policies. It sits beside the security policy, not buried inside it.

The AI system impact assessment

Clause 6.1.4 has no ISO/IEC 27001 counterpart. For each AI system you assess what its deployment, intended use and foreseeable misuse could mean for individuals, groups and societies, and the result feeds the AI risk assessment. Clause 8.4 repeats it at planned intervals and on significant change. The impact assessment guide sets out the method.

A different Annex A, with Annex B guidance

ISO/IEC 42001 Annex A lists 38 reference controls in nine groups, from AI policies and resources to the system life cycle, data, information for interested parties, use of AI and third-party relationships. Annex B, also normative, gives implementation guidance for them. It is a different set from the 93 information security controls, not a copy of them. The Annex A guide explains each group.

Mapping table: ISMS element, what to reuse, what to add

Risk treatment and the Statement of Applicability: similar mechanism, different lens

The treatment clause reads almost the same in both standards: select options, determine the controls, compare them with Annex A so nothing necessary is missed, produce a Statement of Applicability and a treatment plan, and approve the residual risk. Three differences catch ISMS teams out.

• Who is harmed. The AI risk assessment analyses consequences for the organisation, for individuals and for societies. A register copied from the ISMS, scored only on business impact, will not meet it.
• Who approves. ISO/IEC 27001 requires risk owners to approve the treatment plan; ISO/IEC 42001 requires the designated management. Name them in the method so the auditor can see who signed.
• Where the controls come from. The AI Annex A is not exhaustive, so an information security control can appear in the AI treatment plan when it is genuinely needed.

Keep the two Statements of Applicability distinct, each against its own Annex A,. The risk assessment and treatment guide covers the AI method in depth.

A practical sequence for the extension

1. Inventory and scope. List every AI system with an owner and your role; agree which the certificate covers.
2. Gap analysis against the AI content. Sterling's gap analysis measures the existing ISMS against clauses 4 to 10 and the 38 AI controls, marking what can be kept as it is.
3. Policy, criteria and assessments. Approve the AI policy, extend the risk method, then assess each system.
4. Treatment and evidence. Produce the AI Statement of Applicability and plan, put life-cycle, data and supplier records into operation, and train the people involved.
5. One audit, one review. Add AI to the audit programme and review agenda, and close findings before the certification body arrives.

Organisations extending an ISO/IEC 27001 system usually sit at the shorter end of the typical four-to-eight-month range; the number of AI systems sets the pace. Project phases and owners are in the implementation plan guide.

The combined audit and the certification body

Certification bodies audit information security management systems under ISO/IEC 17021-1 with ISO/IEC 27006-1, and AI management systems under ISO/IEC 17021-1 with ISO/IEC 42006:2025, published in July 2025. Accreditation is granted per standard, and accredited ISO/IEC 42001 certification is still new, so your current body may not hold it. Ask which accreditation body has accredited it for ISO/IEC 42001 and confirm that on the accreditation body's public register.

Where one body holds both accreditations, the ISO/IEC 42001 audit can be combined with an ISO/IEC 27001 audit. The accreditation rules for combined audits calculate the audit time for each standard, then allow a justified reduction for the degree of integration, which a genuinely shared system earns more of than two stapled together. Choosing the body is covered in the certification body guide, and what the certificate does not prove under European law in the EU AI Act guide.

ISO/IEC 27001 to ISO/IEC 42001: questions buyers ask