Our recent article on ISO/IEC 42001 vs ISO/IEC 27001 set out what separates the two standards: one governs artificial intelligence, the other information security. Two industry practitioners responded with points that deserve an article of their own.
The differences are real. The way to manage them, however, is not two separate systems.
Same frame, different requirements
Bernard Coetzee, an independent cybersecurity, governance and risk consultant with close to two decades of information security experience across financial services, retail and technology, pointed out that the ISO management system standards share a common foundation. That means they can be seen, and run, together.
Every ISO management system standard is built on the same frame. Once you see that, ISO 27001 and ISO 42001 stop being two projects. Risk does not respect the boundaries between standards, so run them as one system, and AI risk lands in the same register the business already watches.
Bernard CoetzeeIndependent cybersecurity, governance and risk consultant That common foundation is ISO’s Harmonized Structure, known until 2021 as Annex SL. Every recent ISO management system standard uses it, including ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001:2022 and ISO/IEC 42001:2023.
Each has the same ten clauses, the same core text and the same core definitions. Clauses 4 to 10 carry the requirements:
| Clause | What it asks for | Shared between ISO 27001 and ISO 42001? |
|---|---|---|
| 4Context of the organisation | Issues, interested parties, scope | Yes: one context; the scope names both information security and AI |
| 5Leadership | Commitment, policy, roles | Yes: two policies, or one policy with both commitments |
| 6Planning | Risks, opportunities, objectives | Partly: one risk method, but AI adds an impact assessment |
| 7Support | Resources, competence, awareness, documented information | Yes: one document control, one competence record |
| 8Operation | Running the processes and controls | Partly: different controls, one way of running them |
| 9Performance evaluation | Monitoring, internal audit, management review | Yes: one audit programme, one management review |
| 10Improvement | Nonconformity, corrective action, continual improvement | Yes: one corrective action process |
What can be shared
An organisation already certified to ISO/IEC 27001 has most of the machinery ISO/IEC 42001 needs. These can be extended rather than rebuilt:
- The context analysis and the risk method
- Document control and competence records
- Internal audit and management review
- Corrective action and continual improvement
One internal audit programme can cover both standards, and one management review can consider both sets of results. This is the same logic behind PAS 99 and integrated management systems: one skeleton, with each discipline’s specific requirements attached to it.
What stays separate
Sharing the frame does not make the standards interchangeable. Each keeps requirements the other does not have:
- ISO/IEC 27001ISO/IEC 27001 keeps its Annex A of 93 information security controls, and the Statement of Applicability that justifies each one.
- ISO/IEC 42001ISO/IEC 42001 adds an AI system impact assessment, looking at effects on individuals, groups and society. It also has its own Annex A of AI-specific controls, covering areas such as data for AI systems, the AI system life cycle and the use of AI by third parties.
- ObjectivesObjectives and metrics differ. Information security objectives measure confidentiality, integrity and availability; AI objectives also cover fairness, transparency and human oversight.
Where ISO/IEC 27090 fits
If ISO/IEC 42001 tells an organisation how to govern AI, and ISO/IEC 27001 provides the framework for managing information security, a practical question remains: how should AI-specific security threats be identified, assessed and incorporated into the ISMS and risk register already maintained by the organisation?
Wikus van Niekerk, Group General Counsel at Strategix (the XGRC parent group), whose work took Strategix Technology Solutions to ISO/IEC 27001:2022 certification, pointed to the answer: ISO/IEC 27090.
The introduction of AI does not necessarily create a separate compliance regime. POPIA, King IV™ (and especially the new King V™) and ISO/IEC 27001 already require an organisation to determine who is accountable for information and how it is protected. Most organisations already make use of AI through enterprise applications, cloud services and productivity tools, and as such should already form part of their compliance and risk management programmes. The purpose of ISO/IEC 27090 is thus complementary as it provides the ISMS team with a specific and practical way to identify and treat specific AI threats and compromises. The framework, in essence requires the organisation to name the AI threat, assess it, put a control and an owner against it, all while continuously monitoring and improving them.
Wikus van NiekerkGroup General Counsel, Strategix ISO/IEC 27090:2026, Cybersecurity, Artificial intelligence (AI), Addressing security threats and compromises to AI systems, was published in October 2026. It is guidance, not a certifiable standard, and is written to complement ISO/IEC 27001 and ISO/IEC 27002.
- Published
- October 2026
- Type
- Guidance, not certifiable
- Complements
- ISO/IEC 27001 and 27002
It describes threats that ordinary security controls were not designed for, across the AI system life cycle:
- Training data Data poisoning: corrupting training or fine-tuning data so the model learns the wrong behaviour.
- Model inputs Evasion: inputs crafted to make a model misclassify or misjudge.
- The model itself Model extraction and inversion: recovering a model, or the data it was trained on, by querying it.
- Personal data Membership inference: working out whether a specific person’s data was used in training.
- Generative AI Prompt injection: instructions hidden in content that make a generative AI system act against its purpose.
Bringing AI threats into the ISMS you already run
None of this needs a second security programme. Each step below extends something an ISO/IEC 27001 system already has:
-
Inventory. Add AI systems, models, datasets and AI services to the asset inventory (ISO/IEC 27002 control 5.9), including AI features inside software you buy.
-
Risk assessment. Add ISO/IEC 27090 threat scenarios to the existing method in clause 6.1.2, so AI risks are scored and owned like any other.
-
Suppliers. Extend supplier security (controls 5.19 to 5.22) to AI providers: where data goes, whether it trains their models, and how they handle incidents.
-
Development and change. Apply secure development and testing (8.25 to 8.29) to model changes, prompts and training data, not only to code.
-
Monitoring. Log and monitor AI system behaviour (8.15 and 8.16) for signs of misuse, drift or injection.
-
One review. Report AI security risks into the same internal audit and management review that ISO/IEC 42001 and ISO/IEC 27001 already share.
| Ref | Risk | Type | Owner | Rating |
|---|---|---|---|---|
| R-014 | Ransomware encrypts shared file servers | Information securityISO/IEC 27001 | IT Operations | High |
| R-031 | Prompt injection through the customer support chatbot | AI threatISO/IEC 27090 | Digital Channels | High |
| R-032 | AI supplier trains its model on uploaded client data | AI threatISO/IEC 27090 | Procurement | Medium |
| R-047 | Automated CV screening disadvantages some applicant groups | AI impactISO/IEC 42001 | Human Resources | Medium |
| R-052 | Privileged access not reviewed each quarter | Information securityISO/IEC 27001 | IT Security | Medium |
The result is one management system with one risk register, in which AI threats, AI impacts and information security risks are visible side by side.
One system, fewer gaps
Bernard’s point and Wikus’s point arrive at the same place. The standards were designed to fit together, and the newest guidance assumes they will.
Organisations that run ISO/IEC 27001 and ISO/IEC 42001 as separate projects duplicate effort. Worse, they leave gaps where AI risks fall between two registers.
The contributors
Independent cybersecurity, governance and risk consultant with close to two decades of information security experience across financial services, retail and technology.
Group General Counsel at Strategix (the XGRC parent group), whose work took Strategix Technology Solutions to ISO/IEC 27001:2022 certification.
Frequently asked questions
Can ISO/IEC 27001 and ISO/IEC 42001 be implemented as one management system?
Yes. Both follow ISO’s Harmonized Structure, so context, leadership, document control, internal audit, management review and corrective action can be shared. Each standard keeps its own specific requirements and Annex A controls.
Is ISO/IEC 27090 a certifiable standard?
No. ISO/IEC 27090 is guidance on addressing security threats and compromises to AI systems. It is designed to complement ISO/IEC 27001 and ISO/IEC 27002, not to be certified against.
Do we need ISO/IEC 42001 to use ISO/IEC 27090?
No. An organisation with an ISO/IEC 27001 ISMS can use ISO/IEC 27090 to bring AI security threats into its existing risk assessment, whether or not it also adopts ISO/IEC 42001.
What is the Harmonized Structure?
The common structure ISO uses for all its management system standards, formerly called Annex SL: the same ten clauses, core text and core definitions, so standards such as ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and ISO/IEC 42001 can be integrated.
