Select your current compliance foundation to see your path to ISO 42001.
I have ISO 27001
Strongest overlap
I have SOC 2 Type 2
ISO 42001 has a different focus, but SOC 2 is a solid foundation
Carries over from your existing program
Net new work required
Estimated overlap with ISO 42001
~60%*+
Shared structure
Clauses 4-10
Net new focus
AI-specific only
What carries over
Management system structure
Scope, boundaries, and interdependencies determination
Leadership and responsibility assignment
Objectives establishment
Risk assessment methodology
Statement of applicability
Internal audit and performance review process
Management review cycle
Supplier and third-party risk
Incident management
Document control
→
What is net new
AI system inventory
AI impact assessment
AI-specific risk criteria
Human oversight determination**
Training data governance**
Bias and fairness controls**
AI transparency documentation**
Third-party AI vendor oversight**
Typical timeline from ISO 27001
4 to 8 months
but can vary substantially depending on scope, size, and complexity. You are extending an existing management system, not building one from scratch. The bulk of the work is AI-specific uplift.
Estimated overlap with ISO 42001
~30%*+
Carries over
Control discipline
Still needs building
Mgmt system + AI
What carries over
Evidence collection discipline
Access and logical security
Change management process
Vendor risk management
Policy documentation habits
Audit readiness mindset
→
What is net new
Full management system build
Risk assessment methodology
Internal audit program
Management review process
AI system inventory
AI impact assessment
AI-specific risk criteria
Bias and fairness controls
Typical timeline from SOC 2
8 to 14 months
but can vary substantially depending on scope, size, and complexity. SOC 2 builds strong control discipline but not a management system. Both the management system structure and AI-specific requirements need to be built.
* Overlap depends substantially on scope definition.
+ Overlap will vary depending on selected controls.
** Applicability depends on scope and AI system classification.