Crossbearing · standards comparison
ISO/IEC 42001 to ISO/IEC 27701
What you can reuse, what to extend and what is new when you add ISO/IEC 27701 to ISO/IEC 42001.
Compare another pair
What carries over from ISO/IEC 42001 to ISO/IEC 27701
Your AIMS carries the management system over to privacy, and its data and impact controls overlap with privacy by design. The new work is privacy itself: controller and processor roles, lawful processing, people’s rights, and the security controls privacy needs.
Of the 103 clauses and controls ISO/IEC 27701 asks for: 9 to reuse, 19 to extend and 75 new.
- 9 Reuse Use what you have: the same process or document, with its scope widened.
- 19 Extend Keep what you have and add the new standard’s content.
- 75 New Nothing you have covers it: new work.
Do I need to rewrite my policies?
No. Keep the AI policy. Add a privacy policy, and the privacy procedures the controller and processor duties need: handling requests, retention and disposal, contracts with processors and, as a processor, subcontractors.
The management system, clause by clause
Both follow the harmonised structure that ISO management-system standards share, so clauses 4 to 10 line up by number. Each row says what ISO/IEC 27701 asks for and what to do with what your AIMS already has.
| Clause | Your ISO/IEC 42001 | ISO/IEC 27701 asks for | What to do |
|---|---|---|---|
| 4.1 Context | Issues that affect the AIMS, including whether climate change is relevant; the intended purpose of the AI systems the organisation develops, provides or uses; and its role for each — provider, producer, customer, partner and so on. | Issues that affect the PIMS, including whether climate change is relevant, and whether the organisation acts as a PII controller (alone or jointly), a PII processor or both. | Extend Add the privacy laws and contracts that apply, and whether you act as PII controller, processor or both, beside your AI roles. |
| 4.2 Interested parties | Who has a stake in the organisation’s AI, what they require, and which of those requirements the AIMS will address. | Who has a stake in the organisation’s handling of PII — the people it relates to, customers, regulators, processors — and what they require. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 4.3 Scope | The boundaries of the AIMS, taking account of the AI systems and activities it covers. | The boundaries of the PIMS: which processing, systems and roles it covers. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 4.4 The management system | An AIMS that is set up, run, maintained and continually improved, with its processes and how they interact. | A PIMS that is set up, run, maintained and continually improved, with its processes and how they interact. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
| 5.1 Leadership | Top management directs and supports the AIMS: aligned with strategy, built into the business, resourced and communicated. | Top management directs and supports the PIMS: aligned with strategy, built into the business, resourced and communicated. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 5.2 Policy | An AI policy that fits the organisation’s purpose, frames AI objectives and commits to meeting requirements and improving. | A privacy policy from top management that frames privacy objectives and commits to meeting requirements and improving. | New A privacy policy, beside the AI policy or as a clearly marked part of an integrated one. |
| 5.3 Roles | Responsibilities and authorities for the AIMS assigned and communicated. | Responsibilities and authorities for privacy assigned and communicated. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 6.1.1 Risks and opportunities | Plan how the AIMS addresses its risks and opportunities, with criteria that tell acceptable AI risks from unacceptable ones. | Plan how the PIMS addresses its risks and opportunities. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 6.1.2 Risk assessment | An AI risk assessment process, informed by the AI policy and objectives, that takes the results of AI system impact assessments into account. | A repeatable privacy risk assessment of the privacy and information security risks in scope, weighing the consequences for the people whose PII it is as well as for the organisation, with risk owners. | Extend Your AI risk method already weighs harm to people; extend it to the risks of processing PII. |
| 6.1.3 Risk treatment | Choose treatments and controls, with Annex A as a reference, write a Statement of Applicability (6.1.3 f) and an AI risk treatment plan approved by designated management. | Choose treatments and controls, identify and document the information security programme you run (6.1.3 c), check against Annex A, and write a Statement of Applicability (6.1.3 e) and a treatment plan approved by the privacy risk owners. | Extend Identify and document the information security programme that protects PII (6.1.3 c) — an AIMS doesn’t provide one — and write a separate Statement of Applicability against ISO/IEC 27701 Annex A. |
| 6.2 Objectives | AI objectives, with plans for who achieves them, how and by when. | Privacy objectives, with plans for who achieves them, how and by when. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 6.3 Planning changes | Changes to the management system are carried out in a planned way. | Changes to the management system are carried out in a planned way. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
| 7.1 Resources | The resources the management system needs are provided. | The resources the management system needs are provided. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
| 7.2 Competence | People whose work affects AI performance are competent, with evidence kept. | People whose work affects privacy are competent, with evidence kept. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 7.3 Awareness | People know the AI policy, their part in the AIMS, and what not following it means. | People know the privacy policy and their part in the PIMS. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 7.4 Communication | What is communicated, when, to whom and how. | What is communicated, when, to whom and how. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
| 7.5 Documented information | Documents and records the AIMS needs are created, updated and controlled. | Documents and records the PIMS needs are created, updated and controlled. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
| 8.1 Operational control | Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned. | Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 8.2 Risk assessment in operation | AI risk assessments carried out at planned intervals and when significant changes happen. | Privacy risk assessments carried out at planned intervals and when significant changes happen. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 8.3 Risk treatment in operation | The AI risk treatment plan implemented, and its effectiveness checked. | The privacy risk treatment plan implemented. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 9.1 Monitoring and measurement | What is monitored and measured, how and when, and how the results are evaluated. | What is monitored and measured, how and when, and how the results are evaluated. | Extend Keep what your AIMS has here, and add what ISO/IEC 27701 asks for. |
| 9.2 Internal audit | Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements. | Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
| 9.3 Management review | Top management reviews the AIMS at planned intervals, with set inputs and recorded decisions. | Top management reviews the PIMS at planned intervals, with set inputs and recorded decisions. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
| 10.1 Continual improvement | The AIMS keeps getting more suitable, adequate and effective. | The PIMS keeps getting more suitable, adequate and effective. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
| 10.2 Nonconformity and corrective action | Nonconformities are corrected, their causes found and removed, and the actions checked. | Nonconformities are corrected, their causes found and removed, and the actions checked. | Reuse Use your AIMS’s process for both systems, with its scope widened to the PIMS. |
Controls: ISO/IEC 27701 Annex A, against ISO/IEC 42001 Annex A
| ISO/IEC 27701 control | Supported by your ISO/IEC 42001 | What to do |
|---|---|---|
| Controller: lawful processing | ||
| A.1.2.2 Purposes identified and documented | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.2.3 Lawful basis identified and shown |
| Extend Records of how data was acquired help; for PII, also document the lawful basis for each purpose. |
| A.1.2.4 A process for when and how consent is sought | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.2.5 Consent obtained and recorded | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.2.6 Privacy impact assessment for new or changed processing |
| Extend AI impact assessments help; privacy impact assessments are needed for any new or changed processing of PII, not only AI. |
| A.1.2.7 Written contracts with PII processors | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.2.8 Roles agreed with joint controllers | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.2.9 Records that support processing obligations |
| New Data resource records help keep the records your processing obligations need. |
| Controller: people’s rights | ||
| A.1.3.2 Obligations to people identified and met | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.3.3 Deciding what people are told, and when | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.3.4 Clear information given to people |
| New Information for AI users can carry privacy information, but people’s rights need procedures of their own. |
| A.1.3.5 A way to change or withdraw consent | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.3.6 A way to object to processing | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.3.7 Access, correction and erasure | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.3.8 Third parties told of changes, withdrawals and objections | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.3.9 A copy of their PII for people who ask | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.3.10 Procedures for handling requests | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.3.11 Obligations from automated decisions about people |
| New AI impact assessments help you identify the obligations that automated decisions about people bring. |
| Controller: privacy by design | ||
| A.1.4.2 Collection limited to what is needed | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.4.3 Processing limited to what is needed |
| New Data management for AI supports privacy by design if it keeps PII to what each purpose needs. |
| A.1.4.4 PII kept accurate and up to date |
| Extend Data quality requirements carry over to keeping PII accurate and up to date. |
| A.1.4.5 Minimisation objectives and how they are met | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.4.6 De-identified or deleted when no longer needed |
| New Data preparation can de-identify PII; make that the rule once identity is no longer needed. |
| A.1.4.7 Temporary files disposed of on time | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.4.8 Kept no longer than its purposes need | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.4.9 Disposal policies and procedures | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.4.10 Transmitted PII reaches only its destination | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| Controller: sharing and transfers | ||
| A.1.5.2 Basis for transfers between jurisdictions | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.5.3 Where PII may be transferred, documented | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.5.4 Transfers to and from third parties recorded | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.1.5.5 Disclosures to third parties recorded |
| New AI reporting duties help; disclosures of PII to third parties need a record of their own. |
| Processor: lawful processing | ||
| A.2.2.2 Customer contracts cover help with their obligations | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.2.3 PII used only for the customer’s documented purposes |
| New Meeting customers’ AI expectations doesn’t limit you to their documented purposes for their PII. |
| A.2.2.4 No marketing use without the person’s consent | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.2.5 Customers told of instructions that seem unlawful | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.2.6 Customers given what they need to show compliance | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.2.7 Records that support the processor’s obligations | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| Processor: people’s rights | ||
| A.2.3.2 Customers helped to meet obligations to people | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| Processor: privacy by design | ||
| A.2.4.2 Temporary files disposed of on time | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.4.3 PII returned, transferred or disposed of securely | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.4.4 Transmitted PII reaches only its destination | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| Processor: sharing and subcontractors | ||
| A.2.5.2 Customers told the basis for transfers, and of changes | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.5.3 Where PII may be transferred, documented | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.5.4 Disclosures to third parties recorded | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.5.5 Customers told of legally binding disclosure requests | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.5.6 Only legally binding disclosures made, customer consulted | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.5.7 Subcontractors disclosed before use | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.2.5.8 Subcontractors engaged only as the contract allows |
| Extend AI supplier checks carry over; subcontractors processing PII must also be allowed by your customer contracts. |
| A.2.5.9 Customers told of subcontractor changes, with time to object | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| Security for PII | ||
| A.3.3 Security policies covering PII processing | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.4 Security roles for PII processing |
| New AI roles sit beside the security roles PII processing needs. |
| A.3.5 Classification that takes PII into account | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.6 Labelling that takes PII into account | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.7 Rules for transferring PII | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.8 Identities managed through their life cycle | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.9 Access rights to PII granted, reviewed and removed | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.10 Security terms in supplier agreements | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.11 Incident management planned for PII processing | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.12 Incidents responded to by procedure | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.13 Legal and contractual security requirements for PII | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.14 Records about PII protected | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.15 Independent review of PII security | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.16 Compliance with security policies checked | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.17 Awareness and training on PII security | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.18 Confidentiality agreements | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.19 Clear desks and locked screens | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.20 Storage media holding PII managed | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.21 Equipment wiped before disposal or reuse | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.22 User devices protected | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.23 Secure authentication | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.24 Backups, tested | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.25 Logging, protected and analysed |
| New AI event logs are a start; log activity on every system that processes PII, and analyse it. |
| A.3.26 Cryptography and key management | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.27 Secure development life cycle |
| New Your responsible-AI development process is a frame for secure development of systems that process PII. |
| A.3.28 Security requirements for applications | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.29 Secure architecture and engineering principles | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.30 Outsourced development overseen | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
| A.3.31 Test data protected | No counterpart | New Nothing in ISO/IEC 42001 Annex A corresponds: new work. |
What to do with each document
The documented information ISO/IEC 27701 requires, and what to do with yours. Tick each one off as you go: the ticks are kept in this browser only.
A route from ISO/IEC 42001 to ISO/IEC 27701
-
Roles and scope
- Map your processing activities and decide where you act as PII controller or processor
- List the privacy laws and contracts that apply
- Set the PIMS scope beside the AIMS scope
-
Gap assessment
- Go through this page clause by clause
- Check ISO/IEC 27701 Annex A, starting with the controller and processor duties
-
Governance
- A privacy policy approved by top management
- Someone accountable for privacy
- Privacy objectives set
-
Risk
- Extend the risk method to the processing of PII
- Privacy impact assessments for high-risk processing
- Write the Statement of Applicability against ISO/IEC 27701 Annex A
-
Controls
- Lawful basis, notices, rights, privacy by design, transfers
- Processor duties where you process PII for customers
- The security controls for PII in Table A.3
-
Run and check
- Internal audit and management review covering the PIMS
-
Certification
- Ask your certification body about a combined audit, and whether it is accredited for ISO/IEC 27701:2025
Certification and audits
- The certificates are separate, each against its own standard and scope. Since the 2025 edition, ISO/IEC 27701 needs no ISO/IEC 27001 certificate underneath it.
- Ask your certification body about auditing both together, and whether it is accredited for ISO/IEC 27701:2025.
Common pitfalls
- Assuming AI governance covers privacy: lawful basis, rights and processor duties are separate obligations.
- Forgetting the 29 security controls for PII in Table A.3.
- Treating a PIMS certificate as proof of compliance with a privacy law.
ISO/IEC 42001 and ISO/IEC 27701 at a glance
| Fact | ISO/IEC 42001 | ISO/IEC 27701 |
|---|---|---|
| What it is | Certifiable standard | Certifiable standard |
| How it applies | Voluntary, often required by customers | Voluntary, often required by customers |
| How you show it | Certification by an accredited certification body | Certification by an accredited certification body |
| Where | International | International |
| Covers | AI governance, Risk management, Audit & assurance | Privacy, Information security, Audit & assurance |
| Issued or enforced by | ISO and IEC (ISO/IEC JTC 1/SC 42 Artificial intelligence) | ISO and IEC (ISO/IEC JTC 1/SC 27) |
| Current edition or status | ISO/IEC 42001:2023, first edition (December 2023). Supporting standards include ISO/IEC 42005 (impact assessment) and ISO/IEC 42006 (certification bodies). | ISO/IEC 27701:2025 (published October 2025) replaces the 2019 edition and is now a standalone management-system standard. |
Next steps on MajorCyber™
Sources
- ISO/IEC 27701:2025 — Privacy information management systems — Requirements and guidance — International Organization for Standardization (ISO)
- ISO/IEC 42001:2023 — Artificial intelligence — Management system — International Organization for Standardization (ISO)
- ISO/IEC 42006:2025 — Requirements for bodies providing audit and certification of AI management systems — International Organization for Standardization (ISO)
An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.