GirderGroup

ISO/IEC 42001 and 27001: Building an Auditable AI and Information-Security Management System

ISO's management-system standards turn good intentions into certifiable, audited records. With 42001, the world's first AI management system standard, the model now covers AI too.

James OkaforInternational & EU regulation correspondent · London
February 5, 2024 · 8 min read
An audit meeting in a boardroom, illustrating ISO management-system certification.
An audit meeting in a boardroom, illustrating ISO management-system certification. · Image: Girder Group

In December 2023, ISO and IEC published ISO/IEC 42001, the world’s first management-system standard for artificial intelligence (ISO). It matters less for what it says about AI than for what it imports: the ISO management-system model, where a policy is only real if it is documented, owned, audited, and continually improved. That model is why an ISO certificate travels, and why regulators and customers accept it as evidence.

Key takeaways

  • ISO/IEC 42001:2023 is the first certifiable AI management system standard, built on the familiar ISO structure.
  • ISO/IEC 27001:2022 does the same for information security, and the two integrate cleanly.
  • The ISO model's power is evidentiary: certification requires documented, audited, continually improved records.
  • For a firm operating across borders, an ISO certificate is portable proof that a regulator or buyer will accept.

The management-system model, and why it travels

ISO management-system standards share a structure: a stated scope, a policy, defined roles, risk-based controls, documented information, internal audit, and continual improvement. ISO/IEC 27001:2022 applies it to information security; ISO/IEC 42001:2023 applies it to AI. Certification is an external auditor confirming the records exist and the system works, which is why a certificate is accepted as evidence rather than assertion.

That evidentiary quality is the reason to care. A firm that says it governs AI well is making a claim; a firm holding a 42001 certificate has had an auditor verify the documented management system. For an organisation operating across jurisdictions, that portability is valuable: one credible artefact answers many parties.

The two standards also interlock. 42001’s AI controls lean on the information-security foundation 27001 provides, and both share the ISO structure, so a firm already running 27001 can extend into AI governance without starting over. The same is true of ISO 9001 for quality, a standard whose entire logic, as we discuss for regulated manufacturing, is records.

“A policy is only real if it is documented, owned, audited, and continually improved.”

What this means operationally

Decide what certification is worth to you. If customers or regulators ask for portable proof, a certificate answers many of them at once.

Reuse the 27001 foundation for 42001. The shared structure means AI governance can extend, not duplicate, your ISMS.

Treat documented information as the deliverable. The audit tests records; controls without evidence do not pass.

Build continual improvement in, because surveillance audits recur and a stale system fails them.

How AI could address the gap

An ISO management system is, operationally, a machine for producing and maintaining audit evidence: policies linked to controls, controls linked to records, records kept current between audits. Most of the cost is that upkeep.

AI-assisted tooling can keep documented information synchronised with the controls actually in place, flag where a policy and its implementation have diverged before the auditor does, and assemble the evidence pack a surveillance audit requires. The management responsibility stays with the certified organisation; the machine keeps the system audit-ready, the same standing-evidence idea behind the NIST Govern function.

Building the platforms, portals, and systems that make these obligations provable is what Girder Group does.

Sources

  1. 1.ISO/IEC 42001:2023, Information technology, Artificial intelligence, Management system.International Organization for Standardization
  2. 2.ISO/IEC 27001:2022, Information security management systems.International Organization for Standardization

Common questions

Is ISO/IEC 42001 certification mandatory?
Not by law in most jurisdictions, but it is increasingly required by customers, public-sector procurement, and enterprise contracting as a condition for deploying AI systems. For regulated industries using AI in decisions affecting customers, it also provides a defensible governance record.
What is the relationship between ISO/IEC 42001 and ISO/IEC 27001?
ISO/IEC 27001 covers information security management systems; ISO/IEC 42001 covers AI management systems. They share the same Annex SL high-level structure and are designed to integrate, so an organisation with a 27001 system can extend it to cover 42001 obligations without building a separate framework.
What documented information does ISO/IEC 42001 require?
The standard requires documented policies, objectives, roles, risk assessments, and evidence of continual improvement — the same structure as other ISO management systems. The key audit-trigger question is whether the organisation can produce those documents on request.

James Okafor

International & EU regulation correspondent · Girder Group · London

James Okafor covers the FCA, EU regulation, AI governance, and international standards including ISO, from Girder Group's London desk.

Meet the desk

Work with Girder Group

The systems that make these obligations provable.

Girder Group builds the platforms, portals, and cloud systems that regulated organisations run on. Talk to the firm behind this research.

Start a conversation

Stay informed

New research in your inbox.

Briefings on recordkeeping and AI governance, published as the rules develop. We never share your address.

Unsubscribe anytime.

More in this cluster

ISO coverage.

All ISO pieces
Finished products on a line, illustrating ISO records in manufacturing.Analysis

ISO

Why Manufacturers Treat ISO Records as Overhead, Until an Audit

James OkaforLondon · Girder Group · September 30, 2024
A manufacturing operations floor, illustrating ISO 9001 quality records.Research

ISO

ISO 9001 in Regulated Manufacturing: Records as the Backbone of Quality

James OkaforLondon · Girder Group · June 11, 2024

Keep reading.

All research
Stacked coins beside a ledger, illustrating broker-dealer financial recordkeeping.Research

SEC & FINRA

SEC Recordkeeping Requirements for 2026: What Firms Must Retain, and How

Sarah MitchellNew York · Girder Group · January 12, 2025
A retail bank branch sign, illustrating off-channel business communications.Research

SEC & FINRA

FINRA Off-Channel Communication Rules, and Why They Are Reaching Smaller Firms

Sarah MitchellNew York · Girder Group · March 18, 2024
Abstract processor circuitry, illustrating AI governance in financial services.Research

FCA & EU

FCA AI Governance Expectations Under a Principles-Based Approach

James OkaforLondon · Girder Group · December 9, 2024