From ISO 27001 to ISO 42001: Why Your ISMS Is a Head Start

If your organization already runs an ISO 27001 information security management system, you’re significantly closer to ISO 42001 certification than you might think. Both standards share the same Annex SL management system DNA - and after a decade helping companies implement ISO 27001 through our 27kay practice, we can tell you that roughly 40-60% of the work is already done.

That’s not a sales pitch. It’s structural reality.

Why do ISO 42001 and ISO 27001 share so much?

ISO doesn’t reinvent the wheel for every management system standard. Since 2012, all new management system standards follow Annex SL - a common high-level structure that defines the same clause architecture, core terminology, and management system requirements. ISO 27001 follows it. ISO 42001 follows it. So does ISO 9001, ISO 14001, and every other modern management system standard.

This means the bones of your ISMS - the governance framework you spent months building - map directly onto what ISO 42001 expects. Not approximately. Structurally.

What transfers directly from your ISMS?

Here’s what you already have in place if your ISMS is reasonably mature:

• Leadership & commitment (Clause 5) - Top management engagement, policy frameworks, roles and responsibilities. Your information security policy structure translates directly to an AI policy structure.
• Planning (Clause 6) - Risk assessment methodology, risk treatment plans, objectives and planning to achieve them. Your risk framework needs AI-specific criteria, but the process itself carries over.
• Support (Clause 7) - Competence management, awareness programs, communication processes, documented information control. All of this transfers with minimal adaptation.
• Performance evaluation (Clause 9) - Monitoring, measurement, internal audit programs, management review. Your audit program just needs AI-specific audit criteria.
• Improvement (Clause 10) - Nonconformity handling, corrective actions, continual improvement. The improvement engine you’ve built works for any management system.

If that list feels familiar, it should. It’s the same backbone you’re already operating. The management commitment, the risk assessment methodology, the internal audit program, the continual improvement cycle, the document control - all of it carries forward.

What’s genuinely new in ISO 42001?

The Annex SL structure transfers. What doesn’t transfer is the AI-specific substance - and this is where the real work begins:

AI-specific risk assessment. Your ISMS risk methodology handles confidentiality, integrity, and availability. ISO 42001 adds risks around bias, fairness, transparency, explainability, and autonomous decision-making. Same process, fundamentally different risk categories.

AI impact assessment. This is new territory. ISO 42001 requires you to assess the broader impact of your AI systems on individuals and groups - not just security impact, but societal impact. If you’re also navigating the EU AI Act, this aligns closely with the fundamental rights impact assessment required for high-risk systems.

Data governance for AI. Your ISMS covers data security. ISO 42001 goes further into data quality, data provenance, training data documentation, and bias monitoring in datasets. Security is necessary but not sufficient.

Model lifecycle management. From design through development, testing, deployment, monitoring, and retirement - ISO 42001 expects systematic oversight of the entire AI model lifecycle. This has no direct equivalent in ISO 27001.

Third-party AI oversight. Using AI services from vendors? ISO 42001 requires governance over third-party AI just as ISO 27001 requires supplier security management - but with AI-specific evaluation criteria.

Why an integrated management system beats silos

Here’s where it gets interesting from an operational perspective. You don’t need to build a separate management system for AI governance. In fact, you shouldn’t.

Running an integrated management system (IMS) - where your ISMS and AIMS share governance structures, audit cycles, and improvement processes - is significantly more efficient than maintaining parallel silos. One management review covering both. One internal audit program. One document control system. One risk register with both information security and AI risk categories.

We’ve seen organizations at isms.bg run lean, effective management systems precisely because they integrate rather than duplicate. The same principle applies when adding AI governance to the mix.

What does the practical path look like?

If you have a mature ISMS and want to extend it to cover ISO 42001, here’s the approach we recommend:

1. Gap analysis against ISO 42001 Annex A controls. Map your existing ISMS controls to ISO 42001’s AI-specific control set. You’ll find some direct matches, some partial overlaps, and some genuine gaps.
2. Leverage existing processes. Don’t rebuild what works. Extend your risk assessment to include AI risk categories. Add AI criteria to your internal audit checklist. Update your management review agenda.
3. Build AI-specific additions. Focus your effort on the genuinely new requirements: AI impact assessments, data governance for AI systems, model lifecycle documentation, and AI-specific supplier evaluation.
4. Integrate, don’t separate. Run one management system with two scopes rather than two management systems with one governance structure each.

Companies with a mature ISMS can realistically achieve ISO 42001 certification in significantly less time than organizations starting from scratch. The management system foundation - which is often the hardest part to build - is already there.

How we can help

We built aims.consulting specifically for this intersection. As part of the 27kay practice, we bring a decade of ISO management system expertise to AI governance - not as a bolt-on, but as a natural extension of work we’ve been doing since ISO 27001 was the new standard everyone was trying to figure out.

Whether you’re extending an existing ISMS to cover AI governance or building an AI management system from the ground up, we focus on practical implementation over checkbox compliance. Systems that actually work, not just ones that pass audits.

Let’s talk - whether you’re extending your ISMS or starting fresh, we’ll map out the fastest path.