ISO 27001 and ISO 42001 integrated certification means one management calendar and two control sets. Shared clauses are written once when they already exist. A planning band of about 30 to 40 percent less audit time applies only then. It is not a measured result. A certification body still decides the certificate.

The title uses a range. Read it as a planning band, and only when the shared management clauses already exist and the certification body will sample them once. It is not a measured Seven Step result. It is not a rate card. A firm writing both systems from a blank folder should not use that band. ISO 27001 and ISO 42001 integrated certification is worth pricing after the information-security file is real: a scope, a risk method, document control, internal audit and management review that people already follow.

Seven Step Consulting is a consultancy in Gurugram. It does not issue ISO certificates. A certification body does. Check that ISO/IEC 42001:2023 and ISO/IEC 27001 are both in the body’s current scope on the NABCB or IAF directory. NABCB, under QCI, accredits management-system certification bodies in India. This page names no logos and does not call a body accredited from memory.

What ISO 27001 and ISO 42001 integrated certification shares

An integrated management system is the manual and the calendar, not a merged annex. Build the integrated management system on the clauses that already match. In practice, ISO 27001 and ISO 42001 integrated certification writes document control once. Same version rule, same owner field, same place a superseded PDF goes to die. A spreadsheet named Final_v7 on a laptop is still a finding, even if you now have two standards in the header. Treat the integrated management system as the shared calendar, and use the name ISO 27001 and ISO 42001 integrated certification only when that calendar already exists.

Leadership can sit in one cycle. ISO 27001 and ISO 42001 integrated certification still needs an AI policy, not a renamed security policy. The security policy can stay. The AI policy names who may deploy a system and who may stop it. Top management approves both. An email stored next to the PDF is evidence. A slide from an offsite is not.

Document control inside the integrated management system should show version, owner and date for both policies. Internal audit inside the integrated management system needs two sample lists on one plan. Management review inside the integrated management system can be one meeting with two sections: security incidents and objectives, then AI performance, incidents and objectives. Do not buy a workspace and call it an integrated management system before the model owners are named.

Where ISO 27001 and ISO 42001 integrated certification still splits the work

The inventories split. ISO 27001 and ISO 42001 integrated certification does not turn a server list into a model list. Assets stay in the information security file. AI systems get their own rows: purpose, status, owner, and whether the model is yours or a hosted API. A chatbot, a credit model and a vendor copilot are three systems. The copilot is in scope if staff paste customer text into it.

Risk splits too. ISO 27001 and ISO 42001 integrated certification keeps the AI risk assessment beside the security risk assessment. Confidentiality, integrity and availability do not describe harm to a person from a model output. ISO/IEC 23894:2023 can guide the AI risk method. The AI impact assessment is a separate record. ISO/IEC 42005 guides that work. Downtime is a security topic. Effect on individuals or groups is an AIMS topic.

The Statement of Applicability splits. ISO 27001 and ISO 42001 integrated certification means two annexes and two reasons columns. Annex A of the AIMS has 38 controls, from A.2 to A.10. Information security has its own annex. A cell that says “see ISO 27001” with no reason will fail Stage 1. Exclusions are allowed when you truly do not develop models and a development control does not apply. Write the reason in a sentence a stranger can test.

Suppliers split when the vendor is a model API. ISO 27001 and ISO 42001 integrated certification still wants a supplier row for that API, plus the contract clause and a review of what the live call does. A hosting vendor and a model vendor are not the same control.

Shared clauses in an ISO 27001 and ISO 42001 integrated certification programme
Piece of the file Write once, if it already exists Keep separate
Document control, corrective action Yes, one procedure The records still name the right system
Internal audit plan and management review One calendar, one meeting Two samples, two agenda sections
Competence format One template The skill is security or AI, and the name is real
Inventory No Assets in one list, AI systems in another
Risk and impact No Security risk, AI risk assessment, AI impact assessment
Statement of Applicability No One per annex, with reasons
Policy Security policy can remain AI policy still has to be approved

How to read the 30 to 40 percent band

Audit days can fall when the body samples shared clauses once. ISO 27001 and ISO 42001 integrated certification is the name for that plan, not a discount code. Use a planning band of about 30 to 40 percent less audit time and less audit cost only when those shared clauses already exist and the body agrees. That is how to read ISO 27001 and ISO 42001 integrated certification on a proposal. It is a planning band. It is not a measured Seven Step result, and it is not a promise that your invoice will land on that number.

A combined audit samples shared clauses once and AI controls on their own. Ask the certification body whether a combined audit is available for your sites and your headcount. A combined audit does not mean a lighter sample of the model. Stage 1 on a combined audit still reads both documented systems. Stage 2 on a combined audit opens a live model, its purpose and a test record, not only a firewall rule. Surveillance can stay a combined audit if the body agrees and the system count has not jumped. Price a combined audit from audit days, headcount and sites.

Certification body fees for Stage 1 plus Stage 2, as a 2026 India market range for one legal entity, often sit around ₹2 lakh to ₹8 lakh. Those figures are market ranges, not a Seven Step rate card. The 30 to 40 percent planning band applies only to audit effort on clauses you are not writing twice.

A bank or a multi-site firm should not assume the band. ISO 27001 and ISO 42001 integrated certification still grows with sites and with the number of AI systems.

After the certificate, surveillance continues. ISO 27001 and ISO 42001 integrated certification does not end the cycle at Stage 2. The EU AI Act has been in force since 1 August 2024, and most Annex III high-risk obligations have applied since 2 August 2026. The file does not create a presumption of conformity. The DPDP Act, 2023, and the DPDP Rules, 2025, still have their own clock. As of 31 October 2026, Rules 1, 2 and 17 to 21 are in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. Do not treat the full rulebook as already in force.

Upgrade the file you already run

Upgrade your ISO 27001 to cover AI. We will mark which clauses you can keep, which records are missing for the AIMS, and whether one visit can cover both standards for your sites. The planning band stays a band. Write through https://www.sevenstepconsulting.com/contact-us/. Scope for the build is at https://www.sevenstepconsulting.com/iso-42001-aims-artificial-intelligence-management-system/.