ISO 42001 vs ISO 27001: Which should you Get First?
ISO 27001 certifies how you protect information. ISO 42001 certifies how you Govern AI. Which one should a small or mid-sized company get first, and how they can avoid building two systems.
How the AI Management System Standard and the Information Security Standard differ, where they overlap, and the order most small and mid-sized companies should pursue them
ISO 42001 comes up more and more in our conversations with AI-first SaaS companies, usually in one of two forms. "Our customer wants ISO 42001, do we still need ISO 27001?" Or, "We already have ISO 27001, is 42001 just more of the same?"
The short answers are "almost certainly yes" and "no, but closer than you think". The rest of this post explains why.
What is the difference between ISO 42001 and ISO 27001?
ISO/IEC 27001:2022 | ISO/IEC 42001:2023 | |
|---|---|---|
What it Certifies | An Information Security Management System (ISMS) | An AI Management System (AIMS) |
Question it answers | Is the confidentiality, integrity and availability of information and data protected? | Is AI developed, provided and used responsibly? |
Annex A | 93 Controls in four (4) Themes | 38 Controls in nine (9) Areas |
Core Assessment | Information Security risk assessment | AI Risk assessment plus an AI system impact assessment |
Who asks for it | Enterprise and international buyers of any software | Buyers of AI products, regulated sectors, AI-focused procurement |
Certifiable | Yes, by an accredited certification body | Yes, by an accredited certification body |
The difference is easiest to see in what each standard worries about. ISO 27001 is concerned with confidentiality, integrity and availability: can an attacker reach the data, and can you recover if they do? ISO 42001 is concerned with what the AI does: where its training data came from, whether its outputs could harm someone, who oversees it, and what you tell the people affected by it.
An AI system can be perfectly secure and still badly governed. A model locked down to ISO 27001 standards can still make biased decisions, rely on data you had no right to use, or act without human oversight. That gap is what ISO 42001 exists to close.
Where do ISO 42001 and ISO 27001 overlap?
More than most people expect. Both are built on ISO's common management system structure, so Clauses 4 to 10 line up almost one for one:
Clause | What it covers | Reusable from ISO 27001? |
|---|---|---|
4. Context | Scope, interested parties | Yes, extend the scope to your AI systems |
5. Leadership | Policy, roles, top management commitment | Yes, add an AI policy and AI roles |
6. Planning | Risk assessment and treatment, objectives | Partly. The method carries over, but AI risks and impact assessment are new |
7. Support | Resources, competence, awareness, documents | Yes |
8. Operation | Running the risk processes | Partly. AI lifecycle controls are new |
9. Performance Evaluation | Monitoring, internal audit, management review | Yes, run one integrated audit and review |
10. Improvement | Nonconformity and corrective action | Yes |
The overlap continues into a few Annex A areas, such as supplier relationships and incident communication (ISO 42001 control A.8.4). But the heart of ISO 42001 has no ISO 27001 equivalent:
AI System impact assessment. Assessing the consequences of an AI system for individuals, groups and society, not just for your company.
Data for AI systems. Data quality, provenance and preparation across the AI lifecycle.
Information for interested parties. What you disclose to users and others affected by your AI.
Responsible use of AI. Governance, Objectives and processes for how AI is used, including human oversight.
Businesses that build ISO 42001 as a separate management system next to ISO 27001 have wasted money. One integrated system, with one internal audit and one management review, is cheaper to run and easier to defend.
Which should a company get first?
Your Situation | Get First | Why |
|---|---|---|
You sell SaaS and use AI as a feature through a vendor API | ISO 27001 | Buyers ask about security first. Cover AI with a policy and a risk assessment for now |
You build, train or fine-tune models, and AI is the product | ISO 42001, or both together | Buyers' first questions are about how AI is governed |
You already hold ISO 27001 and customers are asking about AI | ISO 42001 | Most of the management system already exists |
You sell AI into Healthcare, Finance, HR or the Public sector | Both, integrated | These buyers ask about security and AI governance in the same review |
Nobody has asked for either yet | Neither | Run a free gap assessment so you know where you stand, and wait for a buyer to send a security questionnaire |
For most SMBs, the answer is ISO 27001 first. It is the credential more buyers recognise, it covers the security of everything you do including AI, and it builds the management system that ISO 42001 reuses. If you are also selling in North America, read how SOC 2 fits alongside ISO 27001, because many SaaS companies need both and the controls overlap heavily.
What does each certification cost a business, and how long does it take?
ISO 27001 | ISO 42001 | |
|---|---|---|
IRM Consulting & Advisory | From $4,250 a month, Walking Tier | From $4,250 a month, Walking Tier |
Time to Audit-ready | Most businesses with a reasonable technical baseline reach it within 90 days | Plan for a 6 to 12 month commitment |
Certification Body | Separate fee, Internal Audit, Stage 1 and Stage 2 Certification Audits, then annual surveillance and internal audits | Separate fee, same audit cycle |
Free Starting Point |
ISO 42001 takes longer partly because the AI risk and impact assessments are new work for most companies, and partly because the AI system inventory is rarely complete when we start. It is common to find AI tools in use that leadership did not know about (Shadow AI). IBM's 2025 breach research for Canada found that one in three Canadian businesses had no access controls on their AI systems, and that breaches involving shadow AI cost about $308,000 more. Its 2026 findings put the average Canadian breach at a record $7.11 million.
If you hold ISO 27001 already, the ISO 42001 project is shorter, because Clauses 4 to 10 and most of your documentation already exist. IRM Consulting & Advisory will prepare you for integrated audits for both standards, which saves time and cost every year.
When does a business not need ISO 42001?
ISO 42001 is a commitment, with annual surveillance audits, and it only pays off when someone recognizes the certificate. You probably do not need it yet if:
AI is a feature you call through a vendor's API, and no customer, regulator or investor has asked how you govern it. An AI policy, a documented AI risk assessment and good vendor due diligence are usually enough for now.
Your buyers have not named it. Questionnaires increasingly ask about AI governance, but many accept a well-documented program aligned to the NIST AI Risk Management Framework without a certificate.
You do not yet have a working security program. Certifying AI governance on top of weak security is building on sand. Fix the foundation first.
If you build or fine-tune models, sell AI into regulated sectors, or answer AI questions in every enterprise security review, the certificate starts to pay for itself, because it answers those questions in one document.
Do Canadian or US Laws require ISO 42001 or ISO 27001?
No. Neither standard is mandated by Canadian or US law for private companies. What the law does require is often easier to show with a certified management system behind it.
In Canada, the proposed federal Artificial Intelligence and Data Act died when Parliament was prorogued in January 2025, and there is no federal AI statute in force. Two bills tabled in June 2026 could change that picture: Bill C-36, which would replace much of PIPEDA and add rights to an explanation and human review of automated decisions, and Bill C-34, which covers online harms including AI chatbots. Neither has passed. AI is still regulated indirectly. PIPEDA governs the personal information your AI processes. Quebec's Law 25 requires you to tell people when a decision about them is made exclusively by automated processing. If you sell to banks or insurers, OSFI's Guideline E-23 on model risk management, which takes effect in May 2027, will shape the questions they ask you about your models.
In the US, the NIST AI RMF is voluntary but widely referenced, and a growing number of state laws address AI used in decisions about people. ISO 42001 gives you one system that can absorb these rules as they change, rather than a new project for each one. Our AI Governance Services can help your business.
What does a 12-month plan for both look like?
For an SMB that needs both, this is the order we recommend:
Months 1 to 3: ISO 27001 readiness. Scope, risk assessment, Statement of Applicability, policy set and controls. Build the AI system inventory at the same time, because you will need it later.
Months 4 to 5: ISO 27001 certification. Internal audit, management review, then Stage 1 and Stage 2 audits.
Months 4 to 9: ISO 42001 build. Extend the scope to your AI systems, run the AI risk and impact assessments, write the AI policy, and add the AI lifecycle controls.
Months 10 to 12: integrated audit. One internal audit and one management review across both systems, then the ISO 42001 certification audit.
Our ISO 42001 Readiness Checklist breaks the AI side into individual tasks, and our ISO 27001 Compliance Guide covers the security side.
Where should you start?
Take both free gap assessments. They take less than an hour each and show you where your controls gaps are. Then look at our ISO 27001 Consulting and ISO 42001 Consulting services, or book a free consultation and bring the customer request that started the conversation.
Related Articles
Does a Small Business in Canada Need SOC 2?
Fractional, Virtual or Interim CISO
How Much Does a vCISO Cost in Canada?
Is your Board asking About AI?
Top vCISO Services for Small Businesses
Best vCISO Providers for Small Businesses - Canada
Our Industry Certifications
Our diverse industry experience and expertise in AI, Cybersecurity & Information Risk Management, Data Governance, Privacy and Data Protection Regulatory Compliance is endorsed by leading educational and industry certifications for the quality, value and cost-effective products and services we deliver to our clients.
We specialize in transforming scaling SMB's, Startups, SaaS businesses in regulated industries into cyber-resilient organizations with cost-effective Virtual / Fractional CISO & AI Governance Services.
Awards & Recognition
