Not just for companies building AI. If your team uses it internally, ISO 42001 already applies to you.

  • Teams with an active or completed ISO 27001 program wondering if 42001 applies to them
  • Organizations already fielding AI-governance questions in security questionnaires
  • Anyone assuming ISO 42001 is only for companies that build AI products (it isn’t — using AI internally is enough)

What you’ll learn:

  • What ISO 42001 actually governs, and why it applies more broadly than most assume
  • Where ISO 27001 and ISO 42001 overlap — and where 42001 adds AI-specific layers
  • The regulatory backdrop: EU AI Act enforcement and a growing set of state-level AI laws
  • Why customer contracts, not regulation, are currently the biggest driver of adoption
  • A realistic certification timeline, from gap assessment to certificate

Same spine, one added layer

Base layer — ISO 27001 (information security management): Governance, risk management, supplier due diligence, incident management, internal audit — the shared clauses that make up the bulk of any ISO management system.

Added layer — ISO 42001 (AI management): The same governance spine, extended with AI-specific requirements: AI impact assessments, training data governance, and oversight across the AI development lifecycle.

Technical control overlap between the two standards is generally estimated at 30–40% on the higher end. Governance-level requirements: policy review cadence, leadership commitment, roles and responsibilities: carry over almost directly.

Session agenda

  1. ISO 42001 overview — What the standard governs, who it applies to, and why AI adoption alone can bring an organization into scope.
  2. The AI governance landscape — Regulatory drivers (EU AI Act, state-level laws) versus the customer-contract pressure driving most current adoption.
  3. ISO 27001 vs ISO 42001 — Where the two standards share a governance spine, and where AI-specific requirements diverge.
  4. The certification path — Gap assessment, AI inventory, risk and impact assessment, scoping, policy build-out, stage 1, remediation, stage 2.
  5. Live audience Q&A — Real questions from attendees on scoping, control overlap, evidence expectations, and certification timelines.

FAQ

Do we need ISO 42001 if we don’t build AI products?

ISO 42001 applies to any organization that uses AI in its operations, not only organizations that develop AI products. If staff use AI tools internally, even informally, the standard is designed to apply to that use.

Is ISO 27001 certification a prerequisite for ISO 42001?

No. ISO 27001 and ISO 42001 can be pursued independently or together. Organizations that already hold ISO 27001 can typically extend their existing management system rather than starting over.

Can ISO 27001 and ISO 42001 be audited together?

Yes. An accredited certification body can perform an integrated management system audit covering both standards, since their core governance clauses are structured almost identically.

How much overlap is there between ISO 27001 and ISO 42001 controls?

Technical control overlap is generally estimated at 30–40% on the higher end, since ISO 42001 governs a different subject (AI risk and outcomes) than ISO 27001’s information security scope. Governance-level requirements overlap much more closely.

How long does ISO 42001 certification typically take?

Timelines vary by organizational complexity and readiness, generally running from roughly 3 months on the short end to closer to a year for larger or more complex organizations, factoring in gap assessment, remediation, stage 1, a recommended 3-week remediation window, and stage 2.

Will an ISO 42001 certificate reduce security questionnaires?

It can reduce the volume of AI-governance questions from procurement teams that recognize the standard, though a certificate alone doesn’t eliminate questionnaires entirely, since certificates summarize scope rather than every control detail a reviewer may ask about.

Does ISO 42001 cover robotic process automation (RPA)?

ISO 42001 doesn’t name RPA-specific controls, but organizations can bring RPA into scope by including it in their AI management objectives and applying relevant controls, including controls imported from other frameworks where appropriate.

Ready to see where your organization stands?

Talk to Our ISO Team, they can walk through your current scope and what an ISO 42001 assessment would involve.

Insight Assurance is an independent audit and assurance organization. This webinar is provided for educational and informational purposes only and does not constitute advisory or consulting services. Insight Assurance performs independent assessments against applicable standards; certification decisions are based solely on audit evidence. Trava Security is a third-party security advisory firm; views expressed by its representatives are their own and do not reflect an endorsement or partnership arrangement with Insight Assurance.

ISO 27001 and ISO 42001 are trademarks of the International Organization for Standardization. Insight Assurance is not affiliated with ISO.