ISO 42001 vs ISO 27001 is a scope question. One standard governs AI systems through an AI management system. The other governs information security. Shared management clauses can be written once. Annex A does not overlap. You need the file that matches the question a buyer or an auditor will actually ask.

A CISO puts two files on the table. One is the ISO 27001 asset register, thick and current. The other is a spreadsheet named Final_v7. The owner column says “AI team”, which means nobody. ISO 42001 vs ISO 27001 starts in that gap. Servers are not models. A patched laptop does not tell you who can stop a scoring model. ISO 42001 vs ISO 27001 is the wrong argument if the board is choosing a logo. It is the right argument if a buyer has asked who owns the system that is already in production.

An AI system that is already in production needs an owner, a purpose, and a record of how it was tested. That sentence is the AIMS in plain words. ISO/IEC 42001:2023 is the AI management system standard. ISO/IEC 27001 is information security. Certification is voluntary. Seven Step Consulting does not issue certificates. A certification body does.

What ISO 42001 vs ISO 27001 separates on day one

On day one, ISO 42001 vs ISO 27001 is an inventory question. Information security inventories assets: people, laptops, applications, suppliers, rooms. The AIMS inventories AI systems: a model you trained, a model you host, and a vendor copilot staff already paste customer text into. Three rows, if you are honest. One row, if Final_v7 hid the copilot.

A month later, ISO 42001 vs ISO 27001 is an evidence question. Stage 1 reads the documented system. Stage 2 samples it working. For information security, the sample might be access reviews and a backup test. For the AIMS, the sample is a live system. The auditor asks for the purpose, the owner, the AI risk assessment, and the AI impact assessment. A policy PDF with no system name will not carry that hour.

Clause 4 names the legal entity, the sites and, for the AIMS, the AI systems. Clause 5 keeps the security policy and still needs an AI policy that says who may stop a system. Clause 6 keeps security risk on confidentiality, integrity and availability. The AI risk assessment asks who could be harmed. The AI impact assessment covers people and groups. ISO/IEC 23894:2023 guides the risk work. ISO/IEC 42005 guides the impact work. Clauses 7 and 10 cover competence and corrective action. A security awareness sheet does not prove the model owner knows the forbidden uses.

Where ISO 42001 vs ISO 27001 changes the Stage 2 sample

The Stage 2 sample is where ISO 42001 vs ISO 27001 stops being a slide. Bring both owners. ISO 42001 vs ISO 27001 fails in the room when only the CISO attends and the model owner is in a release meeting. The person who can switch the system off should be able to open the inventory row, the risk line and the last test note in a minute.

After the visit, ISO 42001 vs ISO 27001 still matters at surveillance audit, because a new model is not a new laptop. Surveillance often runs annually. A model added in month four with no owner is a finding even if the firewall diagram never changed. Recertification sits around year three. Plan the cycle when you book Stage 1, not after the certificate PDF arrives.

A quote PDF that treats ISO 42001 vs ISO 27001 as one copied manual will look cheap until Stage 1. Read ISO 42001 vs ISO 27001 against the question the buyer asked, not against the binder you already paid for. If the product is a model, ISO 42001 vs ISO 27001 usually means you keep the security certificate and add an AI management system. If you have no AI system in production, ISO 42001 vs ISO 27001 collapses. Stay with information security until a system exists. Do not certify an empty inventory.

Side-by-side view of ISO 42001 vs ISO 27001 scope, controls and shared management clauses
Topic Information security file AI management system file
What you list Assets, applications, facilities AI systems, including bought tools
Risk question Confidentiality, integrity, availability Harm from the AI system, and treatment
Impact question Business effect of an incident AI impact assessment on people and groups
Control annex Information security controls Annex A, 38 controls, A.2 to A.10
Applicability Statement of Applicability for those controls Statement of Applicability for Annex A, with reasons
Stage 2 picture A control operating on a record A live model, a purpose, a test record
Typical gap A control with no owner A model with no owner

NABCB, under QCI, accredits management-system certification bodies in India. Check current scope on the NABCB or IAF directory. An accredited ISO 27001 mark is not an AIMS mark until the directory says so. This page names no logos.

What you can write once, and what you must not merge

Firms that already hold a certificate often ask whether ISO 42001 and ISO 27001 can live in one manual. Yes, for the skeleton. ISO 42001 and ISO 27001 share the management-system shape from clause 4 through clause 10. The difference is the subject. ISO 42001 and ISO 27001 do not inventory the same things, and a merged spreadsheet that adds a column called “AI” does not fix that.

A buyer questionnaire that names ISO 42001 and ISO 27001 is asking for two scopes, not one logo on the security page. Document control can serve ISO 42001 and ISO 27001 if the procedure does not pretend a model is just another server. Keep version, owner and date. Retire Final_v7.

Internal audit for ISO 42001 and ISO 27001 can share a calendar and still needs two samples. The security sample can be an access review. The AI sample has to open a live system. The auditor should not audit a system they own. Management review can cover ISO 42001 and ISO 27001 in one meeting if the agenda splits AI performance, incidents and objectives from security incidents. One set of minutes with two headings is easier to defend than two decks that disagree.

A quote that prices ISO 42001 and ISO 27001 as a copy of last year’s security project will miss the AI system inventory, the AI risk assessment and the AI impact assessment. Staff time is the cost people forget. Your model owner still has to sit in the room.

The practical split is AI governance vs information security: who the model affects, versus who can reach the data. A board slide titled AI governance vs information security should show two owners when the CISO does not own the model. AI governance vs information security shows up the day a credit model is fair on paper and the server is patched. Treat AI governance vs information security as two questions in the same risk meeting, not as rival programs.

A Stage 2 sample built around AI governance vs information security will open a model record and an access-control record. If your only pain is a lost laptop, you are still in information security. AI governance vs information security becomes the file you need when the output can harm a person. Suppliers sit on both sides of AI governance vs information security: the model API vendor and the hosting vendor are not the same control. Write the scope line so AI governance vs information security is visible to the certification body before audit days are booked.

Do you need both?

Keep ISO 27001 if the board already relies on it for security. Add the AIMS when you build or buy systems that affect people, prices, claims, credit, hiring or care. The DPDP Act, 2023, and the DPDP Rules, 2025, apply when personal data is in prompts or training sets. As of 31 October 2026, Rules 1, 2 and 17 to 21 are in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. The EU AI Act has been in force since 1 August 2024. Most Annex III high-risk obligations have applied since 2 August 2026. Neither standard creates a presumption of conformity. The RBI FREE-AI report of 13 August 2025 does not make ISO/IEC 42001 mandatory. A full build often takes three to six months. A small inventory can be audit-ready for Stage 1 in about 90 days. That is readiness, not a certificate.

Put the scope on one page so ISO 42001 vs ISO 27001 is visible before you request audit days.

Ask for one quote, split by scope

Integrated certification quote. We will separate the clauses you can share from the AI inventory, the AI risk assessment and the AI impact assessment, and we will not fold the certification body’s invoice into a single number. Write through https://www.sevenstepconsulting.com/contact-us/. The build itself is described at https://www.sevenstepconsulting.com/iso-42001-aims-artificial-intelligence-management-system/.

Before you book two audits by habit

If the board wants one program with two scopes, use this line. Integrated certification quote. We will map ISO 42001 vs ISO 27001 onto the systems you already run and the ones a buyer will ask about next quarter. Start at https://www.sevenstepconsulting.com/contact-us/.