Security Lights the Way

Crossbearing · standards comparison

ISO/IEC 27701 to ISO/IEC 42001

What you can reuse, what to extend and what is new when you add ISO/IEC 42001 to ISO/IEC 27701.

Compare another pair

What carries over from ISO/IEC 27701 to ISO/IEC 42001

Your PIMS carries the management system over to AI, and your privacy impact assessments give the AI system impact assessment a head start. The new work is about AI itself: an AI policy, AI risk, the AI life cycle and data controls, and information for the people who use your AI systems.

Of the 65 clauses and controls ISO/IEC 42001 asks for: 9 to reuse, 19 to extend and 37 new.

  • 9 Reuse Use what you have: the same process or document, with its scope widened.
  • 19 Extend Keep what you have and add the new standard’s content.
  • 37 New Nothing you have covers it: new work.

Clause and control numbers checked against ISO/IEC 27701 and ISO/IEC 42001 themselves; descriptions are MajorCyber™’s own words. Mapping by MajorCyber™, last checked 23 October 2026. Going the other way? ISO/IEC 42001 to ISO/IEC 27701

Do I need to rewrite my policies?

No. Keep the privacy policy. Add an AI policy — its own document or a clearly marked section — and add AI to the privacy procedures it touches: impact assessments, notices and data minimisation.

The management system, clause by clause

Both follow the harmonised structure that ISO management-system standards share, so clauses 4 to 10 line up by number. Each row says what ISO/IEC 42001 asks for and what to do with what your PIMS already has.

Clause Your ISO/IEC 27701 ISO/IEC 42001 asks for What to do
4.1 Context Issues that affect the PIMS, including whether climate change is relevant, and whether the organisation acts as a PII controller (alone or jointly), a PII processor or both. Issues that affect the AIMS, including whether climate change is relevant; the intended purpose of the AI systems the organisation develops, provides or uses; and its role for each — provider, producer, customer, partner and so on. Extend Add the AI systems you develop, provide or use, their purpose and your role for each, beside your controller and processor roles.
4.2 Interested parties Who has a stake in the organisation’s handling of PII — the people it relates to, customers, regulators, processors — and what they require. Who has a stake in the organisation’s AI, what they require, and which of those requirements the AIMS will address. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
4.3 Scope The boundaries of the PIMS: which processing, systems and roles it covers. The boundaries of the AIMS, taking account of the AI systems and activities it covers. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
4.4 The management system A PIMS that is set up, run, maintained and continually improved, with its processes and how they interact. An AIMS that is set up, run, maintained and continually improved, with its processes and how they interact. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.
5.1 Leadership Top management directs and supports the PIMS: aligned with strategy, built into the business, resourced and communicated. Top management directs and supports the AIMS: aligned with strategy, built into the business, resourced and communicated. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
5.2 Policy A privacy policy from top management that frames privacy objectives and commits to meeting requirements and improving. An AI policy that fits the organisation’s purpose, frames AI objectives and commits to meeting requirements and improving. New An AI policy, beside the privacy policy or as a clearly marked part of an integrated one.
5.3 Roles Responsibilities and authorities for privacy assigned and communicated. Responsibilities and authorities for the AIMS assigned and communicated. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
6.1.1 Risks and opportunities Plan how the PIMS addresses its risks and opportunities. Plan how the AIMS addresses its risks and opportunities, with criteria that tell acceptable AI risks from unacceptable ones. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
6.1.2 Risk assessment A repeatable privacy risk assessment of the privacy and information security risks in scope, weighing the consequences for the people whose PII it is as well as for the organisation, with risk owners. An AI risk assessment process, informed by the AI policy and objectives, that takes the results of AI system impact assessments into account. Extend Both standards look at harm to people as well as to the organisation, so your criteria are a good base; add AI risk sources such as data quality, model behaviour and misuse.
6.1.3 Risk treatment Choose treatments and controls, identify and document the information security programme you run (6.1.3 c), check against Annex A, and write a Statement of Applicability (6.1.3 e) and a treatment plan approved by the privacy risk owners. Choose treatments and controls, with Annex A as a reference, write a Statement of Applicability (6.1.3 f) and an AI risk treatment plan approved by designated management. Extend A separate Statement of Applicability against ISO/IEC 42001 Annex A.
6.1.4 AI system impact assessment Nothing here A process for assessing the consequences an AI system’s use and foreseeable misuse could have for individuals, groups and society — documented, and fed into the risk assessment. New New, but not from scratch: your privacy impact assessments cover the personal-data part. An AI system impact assessment also covers groups, society and foreseeable misuse.
6.2 Objectives Privacy objectives, with plans for who achieves them, how and by when. AI objectives, with plans for who achieves them, how and by when. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
6.3 Planning changes Changes to the management system are carried out in a planned way. Changes to the management system are carried out in a planned way. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.
7.1 Resources The resources the management system needs are provided. The resources the management system needs are provided. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.
7.2 Competence People whose work affects privacy are competent, with evidence kept. People whose work affects AI performance are competent, with evidence kept. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
7.3 Awareness People know the privacy policy and their part in the PIMS. People know the AI policy, their part in the AIMS, and what not following it means. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
7.4 Communication What is communicated, when, to whom and how. What is communicated, when, to whom and how. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.
7.5 Documented information Documents and records the PIMS needs are created, updated and controlled. Documents and records the AIMS needs are created, updated and controlled. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.
8.1 Operational control Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned. Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
8.2 Risk assessment in operation Privacy risk assessments carried out at planned intervals and when significant changes happen. AI risk assessments carried out at planned intervals and when significant changes happen. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
8.3 Risk treatment in operation The privacy risk treatment plan implemented. The AI risk treatment plan implemented, and its effectiveness checked. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
8.4 Impact assessment in operation Nothing here AI system impact assessments carried out at planned intervals and when significant changes happen. New Run AI system impact assessments at planned intervals and on significant change, alongside your privacy impact assessments.
9.1 Monitoring and measurement What is monitored and measured, how and when, and how the results are evaluated. What is monitored and measured, how and when, and how the results are evaluated. Extend Keep what your PIMS has here, and add what ISO/IEC 42001 asks for.
9.2 Internal audit Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements. Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.
9.3 Management review Top management reviews the PIMS at planned intervals, with set inputs and recorded decisions. Top management reviews the AIMS at planned intervals, with set inputs and recorded decisions. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.
10.1 Continual improvement The PIMS keeps getting more suitable, adequate and effective. The AIMS keeps getting more suitable, adequate and effective. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.
10.2 Nonconformity and corrective action Nonconformities are corrected, their causes found and removed, and the actions checked. Nonconformities are corrected, their causes found and removed, and the actions checked. Reuse Use your PIMS’s process for both systems, with its scope widened to the AIMS.

Controls: ISO/IEC 42001 Annex A, against ISO/IEC 27701 Annex A

ISO/IEC 42001 control Supported by your ISO/IEC 27701 What to do
Policies for AI
A.2.2 A documented policy for developing or using AI No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.2.3 Other policies aligned with the AI objectives No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.2.4 AI policy reviewed at planned intervals No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
Organisation
A.3.2 Roles and responsibilities for AI
  • A.3.4 Security roles for PII processing Related
New Security roles for PII processing sit beside the AI roles you need.
A.3.3 A way to raise concerns about AI systems No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
Resources
A.4.2 Resources for AI activities documented No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.4.3 Data resources documented
  • A.1.2.9 Records that support processing obligations Related
New Processing records help document the data each AI system uses.
A.4.4 Tooling resources documented No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.4.5 System and computing resources documented No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.4.6 People and their competences documented No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
Impact assessment
A.5.2 A process for AI system impact assessment
  • A.1.2.6 Privacy impact assessment for new or changed processing Related
New Your privacy impact assessment process is a model for the AI system impact assessment process.
A.5.3 Impact assessments documented and kept No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.5.4 Impacts on individuals and groups assessed
  • A.1.2.6 Privacy impact assessment for new or changed processing Partly covers it
  • A.1.3.11 Obligations from automated decisions about people Related
Extend Privacy impact assessments cover the effects of processing PII on people; widen them to groups, to effects beyond personal data, and to foreseeable misuse.
A.5.5 Impacts on society assessed No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
Life cycle
A.6.1.2 Objectives for responsible development No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.6.1.3 Processes for responsible design and development
  • A.3.27 Secure development life cycle Related
New A secure development life cycle is the frame; add responsible-AI steps to it.
A.6.2.2 Requirements and specifications for AI systems No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.6.2.3 Design and development documented No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.6.2.4 Verification and validation No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.6.2.5 Deployment planned and checked No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.6.2.6 Operation and monitoring No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.6.2.7 Technical documentation for those who need it No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.6.2.8 Event logs while AI systems are in use
  • A.3.25 Logging, protected and analysed Related
New Logging for PII processing helps; decide which AI life-cycle events to log while systems are in use.
Data
A.7.2 Data management for development and enhancement
  • A.1.4.3 Processing limited to what is needed Related
New Limiting processing to what is needed applies to training data too; data management for AI adds how datasets are built, versioned and used.
A.7.3 How data is acquired and selected
  • A.1.2.3 Lawful basis identified and shown Partly covers it
Extend A documented lawful basis answers part of how personal data was acquired; also record how data was selected, and your rights to use data that isn’t personal.
A.7.4 Data quality requirements
  • A.1.4.4 PII kept accurate and up to date Partly covers it
Extend Keeping PII accurate is a start; set data quality requirements for everything an AI system is trained and run on.
A.7.5 Data provenance recorded No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.7.6 Data preparation criteria
  • A.1.4.6 De-identified or deleted when no longer needed Related
New De-identification is one kind of data preparation; add criteria for cleaning, labelling and transforming data.
Transparency
A.8.2 Information for the system’s users
  • A.1.3.4 Clear information given to people Related
New Privacy information is a start; people using an AI system also need to know what it does, its limits and how to use it.
A.8.3 A channel to report adverse impacts No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.8.4 A plan to tell users about incidents No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.8.5 Information owed to interested parties
  • A.1.5.5 Disclosures to third parties recorded Related
New Records of disclosures help; AI reporting duties reach regulators, customers and users, about the system itself.
Responsible use
A.9.2 Processes for responsible use No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.9.3 Objectives for responsible use No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.9.4 Use kept to the intended purpose No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
Third parties
A.10.2 Responsibilities shared across the AI supply chain No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
A.10.3 Suppliers of AI services, products and data
  • A.2.5.8 Subcontractors engaged only as the contract allows Partly covers it
Extend Subcontractor checks carry over to AI suppliers; add checks on models, data and responsible-AI practice.
A.10.4 Customers’ needs and expectations met
  • A.2.2.3 PII used only for the customer’s documented purposes Related
New Processing only for your customers’ documented purposes is part of meeting their expectations; add responsible-AI commitments.

What to do with each document

The documented information ISO/IEC 42001 requires, and what to do with yours. Tick each one off as you go: the ticks are kept in this browser only.

A route from ISO/IEC 27701 to ISO/IEC 42001

  1. Scope and roles

    • List the AI systems you develop, provide or use, with their purpose and your role for each
    • Set the AIMS scope beside the PIMS scope

  2. Gap assessment

    • Go through this page clause by clause
    • Check ISO/IEC 42001 Annex A, starting with data and impact assessment

  3. Governance

    • An AI policy approved by top management
    • AI roles assigned
    • AI objectives set

  4. Risk and impact

    • Extend the risk criteria with AI risk sources
    • Build the AI system impact assessment on your privacy impact assessments (ISO/IEC 42005 gives guidance)
    • Write the Statement of Applicability against ISO/IEC 42001 Annex A

  5. Controls

    • Life cycle, data quality and provenance, information for users, responsible use, third parties

  6. Run and check

    • Internal audit and management review covering the AIMS

  7. Certification

    • Ask your certification body about a combined audit, and check it is accredited for ISO/IEC 42001

Certification and audits

  • The certificates are separate, each against its own standard and scope.
  • Ask your certification body about auditing both together, and check it is accredited for AIMS certification: ISO/IEC 42006:2025 sets the requirements for bodies that certify AI management systems.

Common pitfalls

  • Treating a privacy impact assessment as the AI system impact assessment: it leaves out groups, society and effects beyond personal data.
  • Applying minimisation to live data but not to training data.
  • Leaving AI features in bought software out of the AI inventory.

ISO/IEC 27701 and ISO/IEC 42001 at a glance

ISO/IEC 27701 ISO/IEC 42001
What it is Certifiable standard Certifiable standard
How it applies Voluntary, often required by customers Voluntary, often required by customers
How you show it Certification by an accredited certification body Certification by an accredited certification body
Where International International
Covers Privacy, Information security, Audit & assurance AI governance, Risk management, Audit & assurance
Issued or enforced by ISO and IEC (ISO/IEC JTC 1/SC 27) ISO and IEC (ISO/IEC JTC 1/SC 42 Artificial intelligence)
Current edition or status ISO/IEC 27701:2025 (published October 2025) replaces the 2019 edition and is now a standalone management-system standard. ISO/IEC 42001:2023, first edition (December 2023). Supporting standards include ISO/IEC 42005 (impact assessment) and ISO/IEC 42006 (certification bodies).

Next steps on MajorCyber™

Sources

An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.