A buyer sends over a supplier questionnaire. Halfway down, there's a new question: "Do you hold ISO 42001 certification?" A few lines below sits the familiar one: "Do you hold ISO 27001 certification?" If you don't hold either, it's hard to know which to chase first, or whether you need both.
The two standards sound alike, they come from the same family, and they are often sold together. They don't do the same job. ISO 27001 is about keeping information safe. ISO 42001 is about using AI responsibly. One focuses on managing information security risks. The other provides a framework for governing how AI is developed, introduced, used and monitored across an organisation.
Getting the order wrong costs time and money. Some businesses pay for ISO 42001 work when their buyers really want proof of basic security. Others hold ISO 27001 and assume it covers their AI use, then get caught out by questions about bias, testing, human oversight or impact.
This guide sets out the ISO 42001 vs ISO 27001 question in plain terms: what each standard covers, where they overlap, where they differ, and how to decide which one your business needs now. It's written for UK business owners and leaders, not compliance specialists.
Two standards built on the same foundation
Both standards are management system standards. They don't tell you which software to buy. They set out how to run a repeatable system for spotting risks, choosing controls, checking the controls work as intended and improving over time.
What ISO 27001 covers
ISO/IEC 27001 sets the rules for an information security management system (ISMS). Its job is to protect the confidentiality, integrity and availability of your information. That means customer records, financial data, intellectual property and the systems that hold them.
It has been around for nearly 20 years and is widely recognised by buyers. The ISO Survey 2024 counted around 96,700 certificates worldwide. For many larger customers, it's the default proof that a supplier takes security seriously.
Importantly, ISO 27001 is not limited to protecting the organisation itself. Security failures can also affect customers, employees, suppliers, and other parties whose information the organisation holds or processes.
What ISO 42001 covers
ISO/IEC 42001, published in December 2023, sets the rules for an AI management system (AIMS). It's the first international standard written specifically for governing AI. It provides a framework for establishing, implementing, maintaining, and continually improving how an organisation manages AI. This includes understanding where AI is being used, establishing accountability, assessing any risks and impacts, testing, managing suppliers, and introducing appropriate controls throughout the AI system lifecycle. ISO 42001 isn’t limited to businesses developing AI products either, it is also relevant to organisations using AI within their everyday operations, including AI capabilities introduced through existing software like CRM tools. Our guide to ISO 42001 explained covers the standard in more detail.
ISO/IEC 42001 is also much newer. In the UK, BSI became the first body accredited by UKAS to certify against it in January 2026. By October 2026, five UK certification bodies held that accreditation.
What they share
Both follow the same high-level structure used across ISO management standards. The core clauses line up: understanding your context, leadership, planning, support, operation, performance checks and improvement. Both ask for:
A risk assessment and a risk treatment plan
A Statement of Applicability, which lists the controls you've chosen and why
Policies, objectives, training and document control
Internal audits and management reviews
This shared structure is why holding one makes the other easier. A lot of the management work carries straight across.
However, the risks being assessed and the controls needed to manage them aren’t necessarily the same. An organisation can reuse existing management processes while still addressing the additional requirements specific to AI.
Where the two standards really differ
The shared foundation hides some real differences. These are the parts of ISO 42001 vs ISO 27001 that matter when you're deciding.
What they protect. ISO 27001 focuses on managing information security risks, including protecting from unauthorised access, alteration, loss and disruption. Whereas ISO 42001f focuses on managing AI-related risks and opportunities, including how AI systems are developed, selected, deployed, monitored and used. It also considers potential impact on individuals like customers and employees as well as organisations and society.
The impact assessment. ISO 42001 adds an AI system impact assessment that has no match in ISO 27001. On top of the normal risk assessment, you assess the likely effects of each AI system on individuals and society. A CV screening tool that filters out certain candidates is a good example. It might be perfectly secure and still cause real harm.
The controls. ISO 27001's Annex A has 93 controls grouped into four themes: organisational, people, physical and technological. ISO 42001's Annex A has 38 controls focused on AI. These cover areas such as AI policy, the AI system life cycle, data quality for AI, information for people affected by the system, and responsible use. Although some controls areas do overlap, ISO 42001 addresses additional considerations specific to AI, including AI system impact assessments, responsible development and use, and accountability throughout the AI lifecycle.
The questions an auditor asks. An ISO 27001 auditor wants to see access controls and reviews, backups and restoration testing, supplier checks and assessments, and an incident response plan and testing schedule. An ISO 42001 auditor wants to see your AI inventory documentation, the approval process for new AI uses or tools, how you test tool outputs, and how a person can challenge an automated decision, as well as how appropriate human oversight, monitoring and accountability are established for AI systems, including processes for addressing concerns about AI-supported decisions where relevant.
In short, ISO 27001 provides assurance that the organisation has established a system that keeps an individual data safe. Whereas ISO 42001 provides assurance that the organisation has an AI management system in place, but neither certification guarantees that every risk has been eliminated.
Which one fits your business right now
There's no single right order. The answer comes from what your buyers, regulators and own risks are asking for. These four situations cover most UK businesses we speak to.
Start with ISO 27001 if security is the gap
Go for ISO 27001 first if:
Your customers or tenders ask for it, or ask detailed security questions you struggle to answer
You hold sensitive customer data but use AI only in everyday tools, such as writing assistants
You've had a breach or near miss, or have no written security policies at all
This is the more common starting point. The UK government's Cyber Security Breaches Survey 2025 found that 43% of businesses had a breach or attack in the previous 12 months. For most firms, basic security is the bigger and more immediate risk.
Information security is a fundamental business responsibility. However, prioritising ISO 27001 certification doesn't mean AI governance should be postponed. Organisations using AI should still understand how those tools are being used and what additional risks they may introduce and who is accountability if something does go wrong.
Start with ISO 42001 if AI is the product
Go for ISO 42001 first if:
AI sits at the heart of what you sell, such as an AI-powered platform or service
Your AI makes or shapes decisions about people, for example in hiring, lending, insurance or healthcare
Buyers are asking specific AI governance questions, not general security ones
You sell into the EU and need evidence for EU AI Act conversations (our EU AI Act guide explains who it reaches)
Your organisation is introducing AI across multiple business functions and needs consistent governance, accountability and oversight
AI is being used to support operational decisions, customer interactions or the processing of personal or commercially sensitive information
You don't need ISO 27001 in place to start ISO 42001. Security still matters, though. ISO 42001 expects you to protect the data your AI systems use, so you'll cover some security ground either way.
You also don’t need to develop AI products or operate in a highly regulated industry for AI governance to be relevant. Everyday AI use such as AI agents responding to customer emails or an AI chat bot widget on the website or employees using AI to draft marketing campaigns can introduce risks involving inaccurate outputs, supplier dependencies, personal information and unclear accountability.
At the end of the day, the question isn’t simply whether your business needs ISO 42001 certification. It’s whether you understand the AI being used, the decisions it supports and the controls needed to manage it appropriately in order to prevent like customer complaints or losing sales, not only preventing risks.
Plan for both if you sell AI to larger buyers
If you build or sell AI-enabled services to enterprise or public sector customers, expect to need both in time, meaning customers increasingly ask for assurance covering not just information security, but also AI governance. Larger buyers often treat ISO 27001 as the baseline and ISO 42001 as the proof that your AI is governed. Planning both from the start, even if you certify one at a time, saves you rebuilding the same policies twice.
You may not need either certificate yet
You can implement good governance without pursuing certification.
Yes, certification is one way of demonstrating the organisation's use of AI and data are meeting requirements of a standard. However, it isn’t the only way to improve how your organisation manages an individual's data or AI.
Businesses can use ISO 27001 and ISO 42001 as frameworks to improve existing processes, establish accountability and identify areas requiring improvement. For AI governance, this could include:
Maintaining an approval tool inventory of AI systems and other tools
Establishing an approval process for new AI tools and use cases
Deploying an AI Acceptable Use Policy
Assessing AI supplier risks
Assigning clear responsibilities for AI oversight
Defining how AI related incidents, errors and concerns are reported and managed
Providing employees with appropriate training and guidance
Ensure appropriate boundaries are documented and applied to where AI is engaging with customers or clients
The aim should be to establish practical controls that reflect the organisation’s activities and risks, rather than creating documentation solely to satisfy an audit or buyer.
Many businesses start with a clear answer to one question: can staff use AI with customer information?
Common mistakes when choosing between them
These are the ISO 42001 vs ISO 27001 slip-ups that cost businesses the most time.
Assuming ISO 27001 covers AI. It covers the security of AI systems, such as who can access a model or its training data. It doesn't cover fairness, transparency, appropriate human oversight, the impact on people and responsible use requiring additional consideration.
Treating ISO 42001 as an AI quality test. The standard checks that you run a sound management system around AI. It doesn't certify that a particular model is accurate or unbiased.
Chasing a certificate nobody asked for. Before spending money, check what your key customers and tenders actually require. Sometimes a buyer asking about "AI" really wants assurance on data security.
Certification should be driven by business needs, risk exposure, customer expectations and applicable obligations, rather than pursued simply because a standard is gaining attention.
Running two separate projects. Because the foundation is shared, two teams writing two sets of policies leads to duplication and clashes. One integrated system is cheaper to run and easier to audit.
Confusing advice with accreditation. Consultants can prepare you. Only an accredited certification body can certify you. Check that your certifier is accredited for the specific standard, as not every body that certifies ISO 27001 is yet accredited for ISO 42001.
How to prepare for both without doing the work twice
If you expect to need both standards, build once and extend.
Map what you already have. List existing policies, risk registers and controls. Many will serve both standards with small changes.
Build an AI approval inventory. Record every AI tool and system in use, what data it touches and who owns it. This feeds both your ISO 27001 asset list and your ISO 42001 scope.
Use one risk process. Run a single risk assessment method, then add the AI impact assessment on top for AI systems.
Keep one Statement of Applicability per standard, but share evidence. Training records, supplier reviews and incident logs can support both.
Plan a combined audit. Some certification bodies can assess the shared clauses once, then review each standard's controls separately. Ask about this when you request quotes.
The objective is not to force both standards into identical processes. It is to reuse appropriate governance arrangements and evidence while ensuring that the distinct requirements of each standard are addressed.
Let your buyers' questions set the order
The choice between ISO 27001 and ISO 42001 isn’t about which standard is better. It is really about understanding the risks your organisation faces and establishing the governance needed to manage them.
ISO 27001 provides a framework for managing information security whereas ISO 42001 provides a framework for managing AI responsibly through its lifecycle. Together, they can support a more coordinated approach to organisational risk and accountability.
So, there is no universal order. For some organisations, information security will be the immediate priority. While for others particularly those developing, deploying or extensively using AI, AI governance may require equal attention.
At Hyplo, we support UK businesses in understanding how AI is being used, identifying governance gaps and establishing practical processes aligned with recognised frameworks. Whether you’re preparing for certification or looking for greater confidence in how AI is used across your organisation, we can support you in identifying the next steps.
