ISO 27001 and the EU AI Act overlap more than most compliance teams expect, and less than most vendors imply. A working information security management system gives you a real head start on AI Act readiness. It does not give you compliance.
If your organization is already certified, that head start is worth quantifying before you budget for anything new. The management system, risk process, supplier controls, and logging discipline you built for ISO 27001 map onto several AI Act requirements almost directly.
The timing helps. Following the AI Omnibus, which entered into force on 27 July 2026, Annex III high-risk obligations apply from 2 December 2027 — enough runway to extend an existing management system rather than build a parallel one.
In this article, we’ll cover which ISO 27001 controls carry over, where the genuine gaps sit, how ISO/IEC 42001 fits alongside both, and a table showing exactly what to add to each artifact you already hold.
Does ISO 27001 Certification Help With EU AI Act Compliance?
Yes, substantially — but it is a foundation, not a defense. ISO 27001 certification demonstrates that you run a functioning management system with risk assessment, control selection, internal audit, and management review. Several AI Act obligations assume exactly that machinery exists.
Article 17 of Regulation (EU) 2024/1689 requires providers of high-risk AI systems to operate a quality management system covering strategy, design control, testing, data management, post-market monitoring, incident reporting, and record keeping. If you already run an ISMS, you are extending scope rather than starting from zero.
Let’s look at where the overlap is strongest:
| Risk assessment and treatment | Feeds Article 9 risk management for high-risk systems, though the AI Act’s lens is health, safety, and fundamental rights rather than confidentiality, integrity, and availability |
| Logging and monitoring | Supports Article 12 record keeping and Article 26 log retention of at least six months |
| Supplier and third-party controls | Supports Article 25 value chain responsibilities and AI vendor due diligence |
| Documented information and change control | Supports Article 11 technical documentation and the Article 17 quality management system |
| Incident management | Supports Article 73 serious incident reporting, with different triggers and timelines |
| Awareness and competence | Supports Article 4 AI literacy, though the subject matter is new |
That is a genuine head start. In our experience it typically covers somewhere between a third and a half of the management-system effort, depending on how mature the ISMS actually is rather than how recently it was certified.
Where Does ISO 27001 Stop Covering AI?
ISO 27001 stops where the AI Act’s subject matter starts. The standard protects information; the Act protects people affected by automated decisions. Those are different goals, and the gaps between them are not small.
Here are the requirements an ISMS will not cover on its own:
- Fundamental rights impact. Article 27 requires certain deployers to assess the impact of a high-risk system on fundamental rights. No ISO 27001 control asks this question.
- Data governance for training data. Article 10 covers representativeness, relevance, and bias in training, validation, and testing datasets. ISO 27001 governs how data is protected, not whether it is fit to train on.
- Human oversight design. Article 14 requires oversight measures built into the system so a person can understand, intervene, and override. This is a design requirement, not a policy one.
- Accuracy, robustness, and adversarial resilience. Article 15 requires declared accuracy metrics and resistance to attacks on the model itself. Conventional application security testing is necessary here but not sufficient.
- Transparency to affected people. Article 50 requires telling people they are interacting with AI and labeling AI-generated content. This has applied since 2 August 2026.
- Conformity assessment and CE marking. For high-risk systems, a formal conformity route with technical documentation and a declaration of conformity. ISO 27001 has no equivalent.
There is also a scope trap worth naming. Many certified organizations have an ISMS scope that excludes the product engineering environment where AI actually gets built. Check your statement of applicability before assuming coverage.
What Is ISO 42001?
ISO/IEC 42001 is the international standard for an artificial intelligence management system, published in December 2023. It applies the familiar management system structure — context, leadership, planning, support, operation, evaluation, improvement — to the specific risks of developing and using AI.
Its Annex A controls cover ground the AI Act cares about: AI policy, roles and responsibilities, impact assessment, data management across the AI lifecycle, system documentation, and third-party relationships. It is designed to be integrated with ISO 27001 rather than run separately.
The practical appeal is that it gives you a certifiable structure while the AI Act’s own supporting standards are still being finalized. That was a stated reason for extending the high-risk deadlines: the Commission wanted the rules to apply once companies had the right support tools, including standards.
Does ISO 42001 Certification Make You Compliant With the EU AI Act?
No. ISO/IEC 42001 certification does not make you compliant with the EU AI Act, and it does not confer a presumption of conformity. Only harmonized standards published in the Official Journal of the European Union carry that legal effect under Articles 40 and 42.
This distinction matters commercially, because it is frequently blurred. ISO 42001 is an international voluntary standard. Harmonized standards are a specific EU instrument, developed under a standardization request and cited in the Official Journal.
What ISO 42001 does give you is real. It builds the governance muscle the Act assumes, produces much of the documentation you will need anyway, and signals seriousness to customers and regulators. Organizations that certify to it will find AI Act conformity work meaningfully shorter — they will just still have to do it.
One more distinction we should be clear about. CyberGlobal delivers readiness and implementation work for ISO standards. Certification itself requires an accredited certification body, and conformity assessment under the AI Act runs through designated notified bodies or your own declaration where self-assessment applies. We prepare you for those audits; we do not conduct them.
Should You Certify to ISO 42001 or Wait?
The answer depends on whether you build AI or only use it, and on whether customers are already asking. There is no single right call, and we would rather set out the trade-off than push you toward the larger engagement.
Here are a few tips to guide the decision:
- Certify now if you build and sell AI features. Enterprise procurement is already asking for AI governance evidence, and a certificate answers a question that otherwise costs you weeks per deal.
- Certify now if you will be a provider of a high-risk system. You need an Article 17 quality management system regardless. Building it against a recognized standard costs little more than building it ad hoc.
- Extend your ISMS first if you are only a deployer. Add AI to your existing risk register, policy set, and supplier assessment process. Revisit certification when the picture is clearer.
- Wait if AI use is genuinely marginal. A handful of staff using a licensed assistant does not justify a management system standard. Handle it through AI literacy and an acceptable use policy.
- Sequence it either way. Run a gap assessment against both frameworks before committing. A compliance audit that maps existing controls to new obligations usually cuts the eventual scope rather than expanding it.
If you have been through a certification cycle before, the shape will be familiar — our write-up of an ISO 27001:2022 certification project across two sites shows how that sequencing works in practice.
What Does My Company Actually Have to Do If It Is Already Certified?
Being certified changes the shape of the work, not the list. You still owe the same baseline as everyone else: an AI inventory, classification, role definition, a prohibited practice check, governance, an AI use and approval policy, AI literacy training, vendor governance, a transparency check, and an incident route.
The difference is that for most of those, you are extending an existing artifact rather than creating one. That is worth mapping explicitly before you scope anything.
Here’s what you already have, and what you need to add to it:
| Action | What your ISMS already gives you | What you need to add | AI Act reference |
| Build an AI inventory. | Asset register and supplier list | AI-specific attributes: purpose, role, classification, training data source | Art. 3(1) |
| Classify each system. | Risk assessment methodology | Classification against Art. 5, 6, 50, and 51 rather than CIA impact | Art. 5, 6, 50, 51 |
| Define your role. | Nothing directly | Provider, deployer, importer, or distributor per system | Art. 2, 25 |
| Check prohibited practices. | Nothing directly | A one-time screen against the banned practices | Art. 5 |
| Establish AI governance. | Management system, internal audit, management review | AI scope added to the same governance forums | Art. 4, 17 |
| Write an AI use policy. | Policy framework and approval route | AI-specific data rules, disclosure rules, and approval path | Art. 4, 16, 17, 26 |
| Deliver AI literacy training. | Awareness program and training records | AI-specific content, role-differentiated | Art. 4 |
| Vendor governance. | Supplier assessment and contract clauses | AI clauses: documentation access, change notification, log availability | Art. 22–25 |
| Transparency check. | Nothing directly | Review of chatbots, generated content, and deepfake disclosure | Art. 50 |
| Incident route. | Incident management process | AI serious incident triggers and reporting timelines | Art. 73 |
| High risk only: risk management, data governance, technical documentation, human oversight, accuracy and robustness testing, conformity assessment. | Partial: risk process and document control | Substantially new work, mostly engineering rather than governance | Art. 9–15, 43, 48 |
The pattern is consistent. The governance rows are extensions; the engineering rows in the last line are new. If you have no high-risk systems, an already-certified organization can usually close the gap in weeks rather than quarters.
For the full baseline and the breakdown by classification, see our guide to whether the EU AI Act applies to your company.
Frequently Asked Questions
Does ISO 27001 certification help with EU AI Act compliance?
Yes, substantially, but it is a foundation rather than a defense. ISO 27001 gives you a functioning management system with risk assessment, logging, supplier controls, and incident management that several AI Act obligations assume already exists. It typically covers between a third and a half of the management-system effort, depending on the maturity and scope of your ISMS.
Where does ISO 27001 stop covering AI?
ISO 27001 does not cover fundamental rights impact assessment under Article 27, training data governance and bias under Article 10, human oversight design under Article 14, declared accuracy and adversarial resilience under Article 15, transparency to affected people under Article 50, or conformity assessment and CE marking. The standard protects information, while the Act protects people affected by automated decisions.
What is ISO 42001?
ISO/IEC 42001 is the international standard for an artificial intelligence management system, published in December 2023. It applies the familiar management system structure to AI-specific risks, with Annex A controls covering AI policy, roles and responsibilities, impact assessment, data management across the AI lifecycle, system documentation, and third-party relationships. It is designed to integrate with ISO 27001.
Does ISO 42001 certification make you compliant with the EU AI Act?
No. ISO/IEC 42001 certification does not make you compliant with the EU AI Act and does not confer a presumption of conformity. Only harmonized standards published in the Official Journal of the European Union carry that legal effect. ISO 42001 does build the governance structure the Act assumes and produces much of the documentation you will need anyway.
Should you certify to ISO 42001 or wait?
Certify now if you build and sell AI features, or if you will be a provider of a high-risk AI system and need an Article 17 quality management system regardless. Extend your existing ISMS first if you are only a deployer, and wait if AI use is genuinely marginal. A gap assessment against both frameworks before committing usually reduces the eventual scope.
What does my company actually have to do if it is already ISO 27001 certified?
You owe the same baseline as everyone else, but for most of it you are extending an existing artifact rather than creating one. Your asset register becomes an AI inventory, your risk methodology gains AI Act classification, your policy framework gains an AI use policy, your awareness program gains AI literacy content, and your supplier assessment gains AI clauses. Genuinely new work starts at high-risk requirements: data governance, technical documentation, human oversight design, and accuracy and robustness testing.
Strengthen Your Compliance Program With CyberGlobal
Running two overlapping frameworks badly costs more than running one well. The organizations that handle this cleanly are the ones that map the overlap honestly before they buy anything.
But with the right partner by your side, extending what you already have is usually a smaller project than it first appears.
At CyberGlobal, our GRC team works with organizations that already hold certifications and need to know what genuinely carries over. We run the cybersecurity audit and compliance audit work that produces a control map, then help your team close what is actually missing.
We will also tell you when the honest answer is that your existing ISMS covers more than you assumed. That conversation makes us less money and keeps clients longer.
But behind our advanced technology, there are real people — local teams who have sat on both sides of an audit table.
Reach out to CyberGlobal and let us be your ally against today and tomorrow’s cybersecurity challenges.