ISO 27001, ISO 42001, ISO 27701, ISO 9001 and ISO 22301 share the same high-level structure, so context, leadership, risk, internal audit, management review and improvement can be run once for all of them. Certification bodies audit an integrated system in combined visits, which saves auditor days and repeated interviews.
The risk is a system so generic that no standard's specific requirements are visible; the Statement of Applicability and each standard's own controls still need their own treatment. The ISO 42001 framework page covers the AI management system side.
Read more
Related terms
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- ISO 42001
- ISO/IEC 42001 is the international standard for an AI management system: how an organization governs the AI systems it develops or uses.
- ISO 27701
- ISO/IEC 27701 is the standard for a privacy information management system, certifiable on its own since the 2025 edition rather than only with ISO 27001.
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- Management review
- Management review is the recurring review in which top management assesses whether the management system is still suitable, adequate and effective.