I am already ISO 27001 certified: do I have to start over for ISO 42001?

No. The two standards share the management system frame, so much of the work already done also counts toward 42001: what gets added concerns the risks specific to artificial intelligence, not the frame. Treat it as an extension, not as a second system, and that changes the quote worth asking for.

A customer asks for ISO 27001 in the supplier questionnaire: is it mandatory?

Not in general: no rule imposes ISO/IEC 27001 on every company. Some markets do make it an entry requirement: to qualify a cloud service with ACN and sell it to the Italian public administration, you need 27001 with the 27017 and 27018 extensions, or CSA STAR Level 2 certification. Outside those, the obligation is contractual or comes from a tender, so the practical question is not whether it is owed but what the contract requiring it is worth. It is worth asking the customer whether equivalent evidence is accepted, because sometimes it is.

What is ISO/IEC 27001 and how does it relate to 42001?

The international standard for an information security management system, certifiable by third-party bodies.

ISO/IEC 27001 is the international standard setting out the requirements for an information security management system, the ISMS: how the context is established, how risks are assessed and treated, who decides, with which controls and records, and how a third party is shown that all of it genuinely exists. The current edition is ISO/IEC 27001:2022, titled "Information security, cybersecurity and privacy protection. Information security management systems. Requirements", amended in 2024 on climate action changes. In Italy the designation that shows up in questionnaires is the European adoption, UNI CEI EN ISO/IEC 27001:2024+A1:2024, available since October 2024: the label changes, the requirements do not, and here too the adoption does not turn it into a harmonized standard. It is certifiable, and the certificate comes from an accredited third-party body, in Italy normally accredited by Accredia.

See also: ISO/IEC 42001 · The first international standard for an AI management system: voluntary, but certifiable by third-party bodies.

What Annex A adds

A management system describes a method. ISO/IEC 27001:2022 puts an annex alongside it, Annex A, listing 93 controls grouped into four themes: organizational, people, physical, technological. That edition reorganized the list compared with the earlier groupings, and the point is not which controls it holds: it is that the perimeter of what has to be covered is written down. Nobody starts from a blank page, but from a list where each control needs a reason, for applying it or for why it does not concern the company: that reasoning is the statement of applicability, and it is the document an auditor reads first. The technical measures themselves stay the subject of data security.

How it relates to ISO/IEC 42001

ISO/IEC 42001, the standard for an artificial intelligence management system, follows the same common template ISO imposes on every management system standard (Annex SL of the ISO/IEC Directives): the same clauses four to ten, the same machinery of internal audit and management review. That, plus the annex 42001 devotes to integrating it into a management system already in place, is why for a company already holding 27001 it is an extension and not a second system; 27001 is not a prerequisite either, since 42001 is certifiable on its own. For a company already certified the question is therefore not whether to open a new project, but what the extension costs: context, roles, document control and the audit cycle already exist; what has to be redone is the risk assessment on its own criteria and the impact assessment on AI systems, which has no equivalent in 27001. For a company with neither system the order is clear: first the system customers ask for. The logic of the decision to certify is covered in the entry on ISO/IEC 42001.

A concrete example

An IT services provider of sixty people works with two industrial groups and every year receives a supplier questionnaire listing ISO/IEC 27001 as a requirement. The certificate is not there, so it fills in thirty boxes on access and backups by hand, and each renewal costs one extra meeting. The sum is how many times a year that absence costs a negotiation. If the same provider is introducing an AI assistant over client documents, information security is the base the extension rests on.

Why it matters for decision makers

In supplier questionnaires and tenders ISO/IEC 27001 has been a recurring requirement for years, while ISO/IEC 42001 is only starting to appear. That is a practical asymmetry, not a verdict on the two standards: when the choice is which system to build first, the criterion is who is asking for it in writing. It holds the other way round too, when the certificate belongs to a supplier: the standard requires the scope to be declared, which sites and services it covers, and a certificate limited to one site gets presented regularly as though it covered the company. The check is reading that scope, not noting that the certificate exists. The opposite limit needs saying. The certificate does not answer for legal obligations: NIS2 has its own perimeter and its own authority, and presenting the certificate as an answer to those obligations conflates two separate things. What the certificate does do is take off the table the part of the conversation spent arguing whether a method exists.

This entry is informational and does not constitute legal advice: for decisions on regulatory obligations, involve a DPO or legal counsel.