ISO/IEC 42001 + ISO/IEC 27001 Integrated Management System Planner
Holding, or going for, both standards? They share the same clause 4 to 10 structure, so you can run one management system: one scope approach, policy framework, risk method, audit programme, management review and corrective action process. Keep the AI system impact assessment, the two Annex A sets and the Statements of Applicability separate. Pick your starting point below for a plan and a document map.
Saved in your browser only. A planning template, not certification advice.
Shared
6
One process and one set of documents for both standards.
Merge
7
One shared core, with a section or annex per standard.
Separate
3
Kept apart: the content is specific to one standard.
Effort saving
~33%
indicative heuristic, see below
Integration plan
1. Decide the integration model
- Agree with leadership that ISO/IEC 42001 will be added to the existing ISMS, not run as a parallel system.
- Set up one governance forum for both standards, with an AI governance lead and an information security lead reporting into it.
- Decide the scope of each certificate. The scopes do not have to match, but write down where they differ and why.
- Keep two Statements of Applicability, one per Annex A set, cross-referencing shared evidence.
2. Extend the shared elements
- Context and scope: extend the context document with AI-specific issues, interested parties and the organisation's roles with respect to AI systems.
- Policy framework: add the AI policy (or the information security policy) under the same hierarchy, template and approval route.
- Risk methodology: extend the one risk method and register with AI risk sources (or security risk sources), tagged by standard. Keep one set of scales.
- Competence and awareness: add the new competences and awareness modules to the existing framework and training records.
- Documented information: register the new documents and records in the same register and controlled store.
- Internal audit (9.2): extend the one programme to cover the new clauses and Annex A areas; add auditors with the right knowledge.
- Management review (9.3): extend the one agenda to take the inputs of both standards; record decisions per standard.
- Nonconformity (10.2): use the one corrective action process and register, tagged by standard.
3. Build the standard-specific elements
- AI system inventory and the AI-specific context.
- AI system impact assessment process, separate from the risk assessment, and the first assessments for the AI systems in scope.
- AI risk assessment and treatment using the shared method.
- Select and implement the ISO/IEC 42001 Annex A AI controls; write their Statement of Applicability entries.
- AI system life cycle controls: design, verification and validation, deployment, monitoring and change control (including retraining and prompt changes).
4. Run, audit and review together
- Operate both systems for long enough to produce records: most certification bodies want to see the management system operating, including an internal audit and a management review, before Stage 2.
- Run an internal audit cycle that covers both scopes (see the internal audit programme planner).
- Hold one management review that covers both standards and record the decisions.
- Close nonconformities through the shared corrective action process.
5. Certification
- Ask your current certification body whether it is accredited for ISO/IEC 42001 and whether it offers a combined audit with your existing surveillance or recertification.
- If it does, align audit dates; if not, schedule the audits back to back and share the evidence pack.
- Expect separate certificates, one per standard, even when the audit is combined.
Merged document map
Both standards use the harmonized structure (clauses 4 to 10), so most of the management-system layer can be shared. The AI system impact assessment, the two Annex A sets and the Statements of Applicability stay separate.
| Topic | Shared | ISO/IEC 27001 only | ISO/IEC 42001 only |
|---|---|---|---|
| Context, interested parties and scope approachClause 4 Merge | One method for issues and interested parties, one scope-setting approach, one context document with sections per standard. | Information security scope: locations, assets, networks and interfaces. | AI-specific context: the organisation's roles with respect to AI systems, the AI systems in scope, AI-related interested parties. |
| Leadership, roles and responsibilitiesClause 5 Merge | One governance forum and one RACI covering both systems; one management commitment statement. | Information security role holders (for example the ISMS owner). | AI role holders (for example AI system owners, the AI governance lead). |
| Policy frameworkClause 5 Merge | One policy framework: hierarchy, template, approval, review cycle and communication. | Information security policy and topic-specific security policies. | AI policy, and AI topic policies the organisation decides it needs. |
| Risk methodologyClause 6 Merge | One risk method: scales, criteria, risk acceptance, risk owners and one register with a tag per standard. | Information security risk assessment and treatment (confidentiality, integrity, availability). | AI risk assessment and treatment (AI-specific sources of risk such as data quality, transparency, misuse). |
| AI system impact assessmentClause 6 / 8 Separate | – | – | Impact on individuals, groups and society for each AI system. No ISO/IEC 27001 equivalent; keep it as its own process (a DPIA can feed it but does not replace it). |
| Objectives and planning of changesClause 6 Merge | One objectives-setting and tracking process; one change-planning procedure. | Information security objectives. | AI objectives. |
| Annex A control setsAnnex A Separate | – | Annex A information security controls (organizational, people, physical and technological themes). | Annex A AI controls (A.2 policies to A.10 third-party and customer relationships). |
| Statement of ApplicabilityClause 6 / Annex A Separate | – | SoA for the 27001 Annex A controls, with justification for inclusion and exclusion. | SoA for the 42001 Annex A controls, with justification for inclusion and exclusion. |
| Resources, competence and awarenessClause 7 Shared | One competence framework, training records and awareness programme with modules per topic. | Security-specific competences and awareness content. | AI-specific competences (for example impact assessment, data quality, human oversight). |
| CommunicationClause 7 Shared | One communication plan: what, when, with whom, how. | – | Information for users and other interested parties about AI systems. |
| Documented information controlClause 7 Shared | One document control procedure, one register, one retention schedule, one controlled store. | – | – |
| Operational planning and controlClause 8 Merge | One change management and supplier management process with AI and security checkpoints. | Operating the information security controls. | AI system life cycle controls: design, verification and validation, deployment, monitoring, retraining. |
| Monitoring, measurement and evaluationClause 9 Merge | One measurement framework and one reporting pack. | Security metrics. | AI performance and AI system monitoring metrics. |
| Internal audit programme9.2 Shared | One programme covering both scopes, one auditor pool with independence rules, combined or back-to-back audits. | – | – |
| Management review9.3 Shared | One review meeting with one agenda that takes the required inputs of both standards and records decisions for each. | – | – |
| Nonconformity, corrective action and improvement10.2 Shared | One nonconformity and corrective action process and register, tagged by standard; one continual improvement log. | – | – |
You chose two SoAs: keep one per Annex A set and cross-reference shared evidence, so each certification body sees its own controls.
Effort-saving estimate
Indicative heuristicAbout 33% less effort on the elements in the map. Compared with building the ISO/IEC 42001 AIMS as a standalone system. This is not measured data: each element has a relative weight, shared elements save a reuse factor of 0.65 (set by which standard came first, the ISMS state and size), merged elements save half of that, and separate elements save nothing. Use it to compare options, not to budget days.
Grey = standalone effort; orange = integrated effort (relative units).
Audit coordination
Combined or integrated audits of ISO/IEC 27001 and ISO/IEC 42001 are possible when the certification body offers them and is accredited for both standards. Whether audit time is reduced, how findings are reported and how the certification cycles are aligned is decided by the certification body under its own rules: check with your certification body before you plan around it. You normally receive two certificates.
Internally you can already run one programme for both: plan it with the internal audit programme planner.
TL;DRWhat this planner does
5 points
- ISO/IEC 42001 and ISO/IEC 27001 both use the harmonized structure (clauses 4 to 10), so one integrated management system can serve both.
- Share: the context and scope approach, the policy framework, the risk methodology, competence, documented-information control, the internal audit programme, management review and the nonconformity process.
- Keep separate: the AI system impact assessment, the two Annex A control sets and the Statements of Applicability (two SoAs, or one combined with clear separation).
- Tell the planner which standard you hold first, your size and the state of your ISMS, and it gives you an integration plan, a three-column document map and an effort-saving estimate (an indicative heuristic).
- Combined audits are possible when the certification body offers them: check with yours. Free to use, including the Markdown download.
Why integrate rather than run two systems
Two parallel systems mean two risk registers with different scales, two audit programmes competing for the same auditors and two management reviews that leadership sits through twice. Auditors notice when the AI risk register and the security risk register score the same supplier differently. Integrating the management-system layer removes that duplication and keeps decisions consistent.
The limit is the subject matter. An AI system impact assessment asks about effects on people and society that no information security process covers, and the two Annex A control sets answer different questions. Merging those would make both harder to audit, which is why the map keeps them apart.
Start from the ISO 27001 readiness checklist if the ISMS is not yet in place, map shared controls with the AI standards crosswalk, register the merged documents in the documented information register, and plan one audit programme with the internal audit planner.
Frequently asked questions
Can ISO/IEC 42001 and ISO/IEC 27001 share one management system?
Yes. Both follow the harmonized structure used by ISO management system standards, with the same clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. The management-system processes (scope approach, policy framework, risk method, competence, document control, internal audit, management review, nonconformity and corrective action) can be run once for both. What differs is the subject matter: information security for 27001 and AI systems for 42001.
What has to stay separate?
The AI system impact assessment has no ISO/IEC 27001 equivalent and should stay its own process. The two Annex A sets are different: ISO/IEC 27001 Annex A lists information security controls, ISO/IEC 42001 Annex A lists AI controls. Each standard expects a Statement of Applicability for its own Annex A, so either keep two SoAs or one combined document with clearly separate sections.
Should we have one Statement of Applicability or two?
Either can work. Two SoAs are simpler for auditors who certify only one standard, and they keep inclusion and exclusion justifications clean. One combined SoA suits teams that want one control view, as long as the two Annex A sets are clearly separated and each can be read on its own. Ask your certification body which it prefers.
How much effort does integration save?
It depends on how mature the first system is and how much of it is genuinely reused. The planner gives an indicative heuristic only: each element of the document map has a relative weight, shared elements save a reuse factor, merged elements save half of it and separate elements save nothing. It is useful for comparing options, not for budgeting days.
Can we get one combined certification audit?
Many certification bodies offer combined or integrated audits for standards that share the harmonized structure, but only where they are accredited for both. Whether audit time is reduced and how the cycles are aligned is decided by the certification body. Check with yours before you plan around it. You normally receive one certificate per standard.
Is this tool free?
Yes. The plan, the document map, the effort estimate and the Markdown download are free. Your choices are saved in your browser only and nothing is sent to PlayCISO. It is a planning template, not certification advice.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.