Insights

ISO 27001 vs ISO 42001 is a comparison I am asked about constantly. Usually by companies that already hold ISO 27001 or are partway through implementation, and have started using AI in their products or operations. The question is always the same: do we need another standard?

If your organisation already holds ISO 27001 certification and is now developing, deploying, or using AI systems, you are in the strongest possible position to integrate ISO 42001 into your existing management system. Both standards follow the same Annex SL structure. That shared backbone means you are not building a second management system from scratch. You are extending the one you already have.

If you think a successful ISO 27001 audit is about finding as many minor non-conformities as possible, you are missing the point. Audits should be built around finding conformity, not solely hunting for gaps. The difference between the two approaches defines the ISO 27001 auditor mindset that separates a competent auditor from a truly strategic one.

In my experience as a Lead Auditor, I’ve seen many organisations approach ISO 27001 risk assessment as a creative writing exercise. They’ll start by building a massive spreadsheet, filling it with ‘low, medium, high’ labels and hope I don't look too closely at the underlying detail. But in 2026, with cyber threats evolving at machine speed, auditors have had to change their approach to adjust to a much more threatening landscape. What we’re not looking for is a perfect list