ISO 42001 with ISO 27001: integrated audits explained

Can you run ISO 42001 with ISO 27001 in one management system?

Yes, you can run ISO/IEC 42001 and ISO/IEC 27001 as one management system. Both standards apply the same harmonized structure, with identical clause numbers and titles for clauses 4 to 10, so one set of policies, one risk process, one internal audit programme and one management review can serve both. Each standard is still certified separately against its own requirements and its own Annex A. ISO/IEC 27001:2022 has 93 information security controls, while ISO/IEC 42001:2023 has 38 AI controls across nine areas, from A.2 to A.10. Your shared management system therefore needs two statements of applicability, one per standard, and the AI-specific controls such as impact assessment, data provenance and responsible use must be justified on their own terms.

Integration changes the audit, not the standard. Under Global ACI-TECH-3-008, a certification body calculates audit time for each standard separately and then adds them, and any reduction for integration may not exceed 20% of that total. The reduction depends on how far you have integrated documentation, management reviews, internal audits, policy and objectives, processes, improvement and responsibilities, and on how many standards each auditor is qualified for. Confirm this with each certification body before you commit: ask how it will set the reduction, how the team will be competent for both standards, and how the stage 1 audit will confirm the level of integration you declare, since the body may adjust time at that point.

DeployOpen can prepare the shared documentation, the two statements of applicability, the evidence for each control and the integrated internal audit plan, but only an accredited or independent certification body issues certificates. Keep that separation in the contract: the certification body must be independent of the team that built your system. Before you start, check whether your target certification body holds accreditation for ISO/IEC 27001 under the Global ACI arrangement, and note that ISO/IEC 42001 does not yet appear there as an endorsed sub-scope, so confirm how the body's AI certificate is accredited.

What ISO 42001 and ISO 27001 share and where they differ

ISO/IEC 42001 and ISO/IEC 27001 use the same harmonized clause structure, so much of the management system can be written once and reviewed once. The differences sit in the Annex A control sets and in the AI-specific impact assessment requirements, which need their own evidence and owners.

Shared clauses 4 to 10

Both standards use the same clause numbers, clause titles and common terms for context, leadership, planning, support, operation, performance evaluation and improvement. One set of documented information, one scope statement and one management review agenda can serve both. Check that the shared text is written once in the integrated documentation, and that each standard's specific wording (for example, AI system scope versus information security scope) is still traceable in the records.

Shared risk and audit cycle

Clause 6.1 risk assessment, clause 9.2 internal audit and clause 9.3 management review follow the same pattern in both standards. A single risk register can hold AI risks next to information security risks, provided each entry names the standard and control it relates to. Confirm with the certification body how it will treat one internal audit programme covering both systems before you plan the calendar.

Different Annex A control sets

ISO/IEC 42001 Annex A contains 38 AI controls in nine areas, from A.2 policies related to AI through A.10 third-party and customer relationships. ISO/IEC 27001:2022 Annex A contains 93 information security controls in four themes. Controls with similar names, such as supplier management or logging, are not interchangeable: each Annex A control must be justified in its own statement of applicability entry.

AI-specific impact assessment

ISO/IEC 42001 adds AI system impact assessment in clauses 6.1.4 and 8.4, supported by the A.5 controls. ISO/IEC 27001 has no equivalent requirement, so impact assessments on individuals, groups and society need their own method, owners and records. Ask your certification body how it expects impact assessments to be evidenced alongside the risk assessment that both standards share.

AI data and life cycle controls

The A.6 life cycle controls and the A.7 data controls cover design, verification, deployment, technical documentation and data provenance for AI systems. These have no direct counterpart in ISO/IEC 27001 Annex A, although the 27001 controls for secure development and data handling still apply to the same systems. Map which AI system records already exist and which need to be created before the statement of applicability is drafted.

Separate certification rules

Certification bodies for ISO/IEC 27001 follow ISO/IEC 27006-1:2024, and those for ISO/IEC 42001 follow ISO/IEC 42006:2025, each on top of ISO/IEC 17021-1. Integrated audits must follow the combined rules for two or more standards, including the cap on audit time reduction. Confirm with each candidate body whether it holds the scope for both standards, because the Global ACI arrangement endorses ISO/IEC 27001 but has no ISO/IEC 42001 entry.

How the two Annex A control sets differ

Annex A of ISO/IEC 42001 is a reference set of control objectives and controls, not a checklist that every organization must implement in full. Clause 6.1.3 requires a statement of applicability that lists the controls the organization needs and justifies including or excluding each one. The same logic applies to ISO/IEC 27001 Annex A. Before any team counts controls, the organization should decide its AI management system scope, then document which of the 38 AI controls apply to its systems and which do not, with a reason for each exclusion. An assessor will test that reasoning as closely as the controls themselves.

ISO/IEC 27001 Annex A is built around information security, with 93 controls in four themes. ISO/IEC 42001 Annex A is built around the responsible governance of AI systems across nine areas, from A.2 policies through A.10 third-party and customer relationships. The AI-specific areas have no direct counterpart in an information security control set: impact assessment (A.5), data provenance and data quality (A.7), responsible use (A.9) and the allocation of responsibilities with AI suppliers and customers (A.10). A security team that only extends its existing ISMS will usually leave these areas uncovered, so the gap analysis should start from the AI controls rather than from the ISO 27001 list.

Some concerns overlap. Access control, supplier management and logging appear in both management systems, so the organization can define the procedure once, assign one owner and reference it from both statements of applicability. Any such mapping is an internal decision that the organization must document and confirm with its certification body, because no official mapping between the two Annex A sets exists. Evidence is different, however. An access review proves an ISMS control, while an AI impact assessment record, a data provenance log or a documented decision on responsible use proves an AI control, and those records should be planned, owned and retained separately.

Separate certification body rules for each standard

Certification bodies issue the certificates, so their rules decide what an audit must cover. An ISO/IEC 27001 certification body follows ISO/IEC 27006-1:2024, and a body certifying ISO/IEC 42001 follows ISO/IEC 42006:2025. Both documents add requirements on top of ISO/IEC 17021-1, the general rules for bodies that certify management systems. A body can hold both competences, but it must show that its auditors and processes meet each set of rules separately.

Two rulebooks: The body must apply the ISO/IEC 27001 rules to the security scope and the ISO/IEC 42001 rules to the AI scope, even when one audit team covers both.
Competence per standard: Auditors need knowledge of each standard. Ask which auditors hold AI management system competence and how that was evidenced.
Separate scope statements: The certificate scope for each standard should name the systems and AI activities covered, not a general reference to the integrated program.
Nonconformity effects: The body should explain how a finding against one standard is assessed for its effect on the other.
Named standard editions: Confirm the body references the 2022 edition of ISO/IEC 27001 and the 2023 edition of ISO/IEC 42001 in its documents.

Ask the body in writing which edition of each rulebook it applies and who will sign each certificate.

How an integrated audit is planned and run

An integrated audit confirms that one certification body can assess ISO/IEC 42001 and ISO/IEC 27001 together, that the audit team covers both standards, and that every finding is weighed against both. Each phase produces a written output that the next phase relies on, and the certification body decides the outcome.

Declare the intended level of integration
The organization states, in writing, which parts of its management system are shared across ISO/IEC 42001 and ISO/IEC 27001, such as integrated documentation, a single management review, a joint internal audit program, common policies and objectives, shared processes, and common responsibilities. The declaration is the input the certification body uses to set the audit approach. It is done when the organization has a written integration declaration and has asked the certification body to review it before accepting the proposal.
Confirm the declared integration at stage 1
The certification body's stage 1 audit checks whether the integration described in the declaration exists in practice, for example whether the AI policy and information security policy are aligned, whether one management review covers both scopes, and whether the internal audit program tests both standards. Under the Global ACI rules, the certification body may adjust audit time based on what it finds. It is done when the stage 1 report records the confirmed level of integration and any changes to the audit time.
Build the combined audit plan and team
The certification body calculates audit time for each standard separately and then applies any integration reduction, which the Global ACI rules cap at 20% of the combined total. It assigns an audit team in which each auditor is competent for each standard as a whole, and a team leader who is competent in at least one of them. The organization confirms the plan, the sites, the interviewees and the sampling of AI systems and security controls. It is done when the audit plan names every auditor, the standards each one covers, and the processes that will be tested against both standards.
Test both standards during the stage 2 audit
Auditors examine the AI management system against the clauses of ISO/IEC 42001 and the information security management system against ISO/IEC 27001, using a single set of records wherever the organization has integrated its processes. Evidence for the AI impact assessment, the AI risk treatment and the Annex A controls is checked alongside the security risk assessment and the security controls in the statement of applicability. It is done when each auditor has tested the processes assigned to them and recorded the evidence reviewed for each requirement.
Record findings against each standard
Every finding is classified against the standard it affects. The team also considers whether a nonconformity against one standard affects the other. For example, a gap in access control for training data may weaken both an AI system requirement and an information security control, and the report should say so. The organization can respond with corrective action plans for each finding. It is done when each nonconformity has a clear standard reference, a documented effect on the other standard where relevant, and a corrective action deadline set by the certification body.
Issue the combined report and certification decision
The certification body reviews the findings, verifies the corrective actions and makes the certification decision for each standard. The combined report should show the audit scope, the integration level confirmed at stage 1, the team composition, and the outcome for each standard. The organization should check that the certificates name the correct standards, scopes and accreditation status before relying on them. It is done when the certification body has issued a decision for each standard and the organization has verified the certificates with the certification body.

How integrated audit time and savings are calculated

An integrated audit does not produce a single discount that the certification body applies by default. Under Global ACI-TECH-3-008 (M), issued 10 July 2026, the certification body first calculates audit time for ISO/IEC 42001 and for ISO/IEC 27001 separately, then adds the two totals together. Only after that sum exists may the body reduce it for integration, and the reduction may not exceed 20% of the combined total. Read the 20% figure as a ceiling, not a target. A reader should expect the body to start from two complete audit-time calculations and then show how much of the combined figure, if any, it is removing and why.

The size of that reduction depends on how far the two management systems really operate as one. Global ACI-TECH-3-008 Annex 1 looks at integrated documentation, joint management reviews, joint internal audits, a common policy and objectives set, shared processes, a single improvement cycle and clearly assigned responsibilities. It also looks at how many of the standards each auditor is qualified for. An organization that keeps separate AI and information security procedures, separate review meetings and separate owners will earn little or no reduction, even if the two Annex A control sets overlap in practice. The stage 1 audit confirms the declared level of integration, and the body may adjust audit time at that point, so an overstated integration claim can cost time later rather than save it.

The savings are therefore a reduction in one certification body's time estimate, not a fixed discount that carries across providers or years. Before signing, ask the body for the audit-time calculation in writing: the separate time for each standard, the integration factor applied and its justification against each Annex 1 element, the auditor qualifications assumed, and the total days for each stage and each surveillance year. Ask how a nonconformity against one standard is treated for the other, since the standard requires that question to be considered. If a quote does not show these lines, you cannot compare it with a quote from another body.

What an integrated audit costs compared with two separate audits

This table compares who is paid for each cost component when ISO/IEC 42001 and ISO/IEC 27001 run as two separate audits or as one integrated audit. Read each row for who bills the work, whether it is one-time or recurring across the three-year cycle, and what moves the amount up or down.

Cost component	Who is paid	One-time or recurring	What drives it
Standards purchase	ISO or the national standards body, for ISO/IEC 27001:2022 (CHF 155) and ISO/IEC 42001:2023 (CHF 225) as published prices	One-time	Number of standards bought and any companion documents the team decides to buy
Stage 1 and stage 2 certification audits, each standard	Certification body, billed per standard against its own audit time calculation	One-time per standard, repeated at recertification	Number of standards, level of integration declared, sites and AI systems in scope
Surveillance audits, each standard	Certification body, for each standard during the three-year cycle	Recurring across the three-year cycle	Number of standards, sites and AI systems in scope, and any change in scope
Integration reduction on audit time	Certification body applies it when it sets audit time, so it lowers the certification body invoice	Recurring at each audit event	Integrated documentation, shared management reviews and internal audits, and auditor qualifications for more than one standard. Confirm the cap in writing
Gap work and shared documentation	Implementation partner, if engaged under a written scope	One-time, with periodic updates	Current state of existing ISO 27001 controls, depth of AI system documentation, and how much policy content is shared
Tooling and evidence systems	Vendors, or internal platform costs for self-hosted tools	Mostly recurring	Whether one evidence store serves both standards, and how many AI systems are logged
Internal staff time	Your own employees, auditees and internal auditors, not invoiced	Recurring, with a spike before stage 1 and stage 2	Number of owners who support both standards, and how well roles are defined across both
Quote requirement	Ask each certification body for a quote based on a written scope listing standards, sites, AI systems and declared integration level	Applies to every quote	Shared scope in one document makes two quotes comparable and reveals any mismatch in audit time

Decisions that change the integrated audit scope

An integrated audit of ISO/IEC 42001 and ISO/IEC 27001 is priced and scoped from a small set of early choices. Each choice below changes how much audit time the certification body can justify, so settle them in writing before the audit plan is set.

Which AI systems sit in scope

Decide which AI systems, business units and suppliers fall inside the AI management system and which stay inside only the ISMS. Systems that process personal data or support security functions often belong in both, and the boundary must match in each scope statement. A narrow AI scope with a broad ISMS scope creates overlapping audit samples that the certification body may charge for twice. Confirm the boundary with the certification body before the stage 1 plan is drafted.

One document set or two

Decide whether a single set of integrated documents covers both standards, such as one policy set, one risk register and one statement of applicability per standard. The harmonized clause structure makes a shared set practical, but the Annex A control sets differ, so each statement of applicability must still justify its own controls. The degree of document integration is one of the factors that can support a reduction in audit time, so record the choice and show it working during stage 1.

One owner or two teams

Decide whether one accountable owner runs both management systems or whether AI governance and information security have separate leads. Shared management reviews, internal audits and a single corrective action process reduce duplicated effort and support integration credit. Separate owners are workable, but they need documented coordination on risk, incidents and supplier reviews. Name the owner, deputy and internal auditors early, because auditor competence is checked against each standard.

Certify together or in sequence

Decide whether both standards are certified in one audit cycle or whether ISO/IEC 27001 certification comes first and ISO/IEC 42001 follows. A combined audit usually needs fewer total audit days, but it needs more preparation and a team competent for both standards. Sequencing spreads cost and internal effort, but the second audit may repeat evidence checks. Ask each certification body how it would plan each option and what it would charge for each.

Competence of the audit team

Ask how the certification body staffs an integrated audit. Global ACI-TECH-3-008 requires the team to be competent for each standard as a whole and led by a team leader competent in at least one of them. The number of standards each auditor covers affects how much integration reduction the body can apply. Confirm the names and qualifications of the proposed auditors before accepting the audit plan, since a team that lacks one standard can push the audit back into separate days.

Handling cross-standard nonconformities

Agree in advance how a nonconformity under one standard is treated when it touches the other. Global ACI-TECH-3-008 requires the certification body to consider whether a nonconformity against one standard affects the other, so a weak access control finding could also count against an AI data or supplier control. Ask how findings are classified, how corrective actions are shared, and whether a single fix closes both records. Clear rules here prevent a finding in one standard from reopening the whole audit.

How to sequence the two standards for a first certification

The sequence builds one shared management system core first, then layers AI-specific evidence on top, so a single internal audit and management review can cover both standards before the certification body is engaged.

Confirm scope and statements of applicability
Agree the boundary of the AI management system and the information security management system, including which products, AI systems, business units, sites and suppliers fall inside each. Record the result in a scope statement for each standard, then draft a separate statement of applicability for ISO/IEC 42001 (clause 6.1.3, justifying every Annex A control included or excluded) and for ISO/IEC 27001. Owners are the management system lead and the business owners of the AI systems. This step is done when both scope statements and both statements of applicability are approved by management and the overlap between them is written down.
Map shared clauses 4 to 10 into one document set
Because ISO/IEC 42001 uses the same clause numbers, titles and common terms as ISO/IEC 27001, write one set of documented information for context, leadership, planning, support, operation, performance evaluation and improvement, with sections that address each standard where they differ. Typical shared records include the context of the organization, the policy, the roles and responsibilities, the risk assessment method and the objectives register. Owners are the management system lead and process owners. This step is done when each clause has one controlled document that names the requirement it satisfies for both standards.
Build AI-specific Annex A evidence
Add the records that only ISO/IEC 42001 asks for. These include AI system impact assessments under clauses 6.1.4 and 8.4 and the A.5 controls, a resource record and data records under A.4 and A.7, AI life cycle records under A.6, and information for interested parties under A.8. Keep these alongside the ISO/IEC 27001 Annex A evidence (access records, change records, supplier reviews) rather than in a separate silo, and cross-reference where a single control serves both standards. Owners are AI system owners, data owners and security. This step is done when every AI control marked as applicable has a named record and a responsible owner.
Run the risk assessment and treatment once for both
Perform AI risk assessment and treatment (clauses 6.1.2, 6.1.3, 8.2 and 8.3) and the information security risk assessment and treatment in one combined exercise where risks overlap, such as model access, training data exposure and supplier failures. Keep separate risk criteria where the two standards define impact differently, and record which risks belong to which standard. Owners are the risk owners named in the register. This step is done when the risk treatment plan lists each treated risk with its controls and the statement of applicability entries that reference it.
Run one internal audit covering both standards
Conduct a single internal audit program against both standards, with auditors trained to the requirements of each. Auditors should be assigned so that the audit team covers the AI and security controls, and findings should be recorded against the standard they affect. Where a nonconformity against one standard may affect the other, note the link explicitly, since certification bodies will consider it. Owners are the internal audit lead and the auditors. This step is done when an internal audit report lists findings for each standard, each with a corrective action and an owner.
Hold one management review for both systems
Hold a single management review that covers the performance of the AI management system and the information security management system together, including internal audit results, risk treatment status, impact assessment outcomes, incidents, objectives and improvement opportunities. Record the decisions and resourcing actions separately for each standard so that evidence can be traced. Owners are top management and the management system lead. This step is done when the management review minutes record inputs, decisions and actions for both standards and are approved.
Confirm the integration level and book the certification body
Before choosing a certification body, confirm with each candidate how it will calculate audit time for an integrated audit, what reduction it applies, and whether it holds accreditation for ISO/IEC 42001 and ISO/IEC 27001. Under the Global ACI rules, time is calculated for each standard and added, with any integration reduction capped at 20% of that total, and the stage 1 audit confirms the declared level of integration. Ask for the written quote, the team competence statement and the audit plan. Owners are the management system lead and procurement. This step is done when the written contract and audit plan name the standards covered and the declared integration level.

Questions buyers ask about ISO 42001 and ISO 27001 together

Can one certification body certify ISO 42001 and ISO 27001 at the same time?

Yes, one certification body can audit an organization against both standards in a single integrated audit, but the body must be competent for each standard. Global ACI-TECH-3-008 applies to audits against two or more standards at the same time and requires an integrated audit team to be competent for each standard as a whole, led by a team leader competent in at least one of them. The catch is accreditation scope: ISO/IEC 27001 with ISO/IEC 27006-1 appears as an endorsed sub-scope in Global ACI-FMRA-001 version 3.3, but ISO/IEC 42001 does not yet appear there. Ask the body to show its accreditation scope for each standard before you sign.

Is a combined ISO 42001 and ISO 27001 certificate issued?

Not as a single document in the sources reviewed here. Certificates are issued by the certification body, not by ISO or by DeployOpen, and each standard has its own certification rules. Under ISO/IEC 27006-1:2024 for information security bodies and ISO/IEC 42006:2025 for AI bodies, both on top of ISO/IEC 17021-1, the body decides how it documents each scope. Ask the body in writing how it will issue certificates for each standard, which certificate numbers and scope statements will appear, and how a customer can verify each one.

Does ISO 27001 certification cover AI systems?

No. ISO 27001 certification covers the information security management system and its 93 Annex A controls, which address information security in general. It does not assess AI-specific topics such as AI impact assessment, data provenance for AI systems or responsible use of AI. ISO/IEC 42001 Annex A has 38 controls across nine areas, from A.2 to A.10, covering those AI-specific topics. Overlap exists in areas such as risk assessment, access and supplier management, but each standard must be assessed against its own requirements and its own statement of applicability.

How much internal effort does an integrated audit save?

The saving comes from shared work, not from skipped requirements. Global ACI-TECH-3-008 requires the certification body to calculate audit time for each standard separately and add them, and any reduction for integration may not exceed 20% of that total. Annex 1 ties the reduction to the level of integration, including integrated documentation, management reviews, internal audits, policy and objectives, processes and responsibilities. Your internal saving is largest when both standards share one document set, one set of internal audits and one management review. Ask the body to show how it set the reduction and how stage 1 confirms the declared integration level.

What does the organization need to provide for an integrated audit?

The organization must provide the evidence for both management systems, owned and maintained by its own people. Core items include a defined scope for each standard, a statement of applicability for each Annex A set, the AI policy and information security policy, risk and AI impact assessment records, internal audit reports, management review minutes and records of nonconformities and corrective actions. Clauses 4 to 10 are shared in structure, so one set of processes can serve both. Ask the certification body for its document request list before stage 1 and confirm which records it will sample.

Can we run an integrated ISO 42001 and ISO 27001 program ourselves?

You can, provided you own the controls and the competence to run them. The organization is responsible for its controls, its evidence and its management system decisions. An implementation partner such as DeployOpen can prepare systems, controls and evidence for an assessment, but it does not issue audit reports or certificates, and only the independent certification body does. Teams without internal experience in both standards often use outside help for gap analysis and evidence design, then keep ownership in-house. Confirm the scope, deliverables and timeline in writing before work starts, and make sure the internal owner can answer auditor questions without the partner present.

What usually delays or inflates a combined project

Most delays in a combined ISO/IEC 42001 and ISO/IEC 27001 project come from planning mistakes made before the first audit, not from the audit itself. The cards below cover the decisions that most often add time and fees, and the check that prevents each one.

Assuming the Annex A sets map one to one

ISO/IEC 42001 Annex A has 38 AI controls in nine areas, while ISO/IEC 27001:2022 Annex A has 93 information security controls in four themes. Many teams assume each AI control has a security twin and build a crosswalk that pairs them, then discover that impact assessment, data provenance and responsible use have no direct counterpart. Build the crosswalk from clause requirements and your own risks, and mark which controls each standard alone covers. Ask your certification body how it will review shared controls before you finalize the statement of applicability.

Choosing a body without checking accreditation

ISO does not certify organizations, and accreditation of certification bodies for ISO/IEC 42001 is voluntary. The Global ACI recognition arrangement lists ISO/IEC 27001 with ISO/IEC 27006-1 as an endorsed sub-scope but has no ISO/IEC 42001 entry, so a certificate's accredited status cannot be assumed. Confirm with the body, in writing, whether the ISO/IEC 42001 certificate it would issue is accredited and under which accreditation body. Check that its auditors follow ISO/IEC 42006:2025 on top of ISO/IEC 17021-1 before you pay for a stage 1 audit.

Leaving integration level undefined until stage 1

Under Global ACI-TECH-3-008, the reduction in audit time for an integrated audit depends on how far the two systems actually share documentation, management reviews, internal audits, policies, objectives, processes and responsibilities. A reduction may not exceed 20% of the summed time for each standard. If the organization has not decided its integration level beforehand, stage 1 becomes the place where it is decided, and the certification body may then adjust audit time. Write the declared integration level into the plan and confirm it with the body before the audit is scheduled.

Duplicating documents across two systems

Teams often maintain separate policy sets, risk registers, internal audit programs and management review minutes for each standard. The duplicates drift apart within months, and auditors then find conflicting statements about the same risk or owner. Keep one integrated document set where the harmonized clauses 4 to 10 overlap, with a clearly labeled AI-specific annex for clauses and controls that only ISO/IEC 42001 requires, such as AI system impact assessment in clauses 6.1.4 and 8.4. Assign each document one owner and one review date.

Scoping AI systems inconsistently with the ISMS

An ISMS scope is usually drawn around products, sites or business units, while AI systems often cross those boundaries. A customer-facing model may run on a shared cloud platform, use third-party training data and feed a product owned by another team. If the AI management system scope and the ISMS scope describe different systems, the same asset appears in one register and not the other, and risk ratings disagree. Agree one inventory of AI systems and their supporting assets, then state in both scope documents which systems fall inside each boundary.

Treating nonconformities as single-standard findings

An integrated audit team must be competent for each standard as a whole and must consider whether a nonconformity against one standard affects the other. A gap in access control, for example, can also weaken an AI data governance control, yet teams often close the finding only under the standard that raised it. Ask the certification body how it records cross-standard findings, and build corrective actions that name every affected clause and control. Keep a single register so one fix can be verified against both standards.

Who owns each part of a combined certification

Your organization owns the management system itself. Every control you keep in the statement of applicability, every policy, and every risk decision has to be made and signed off by people inside the company, because an assessor will ask who made each call and why. Ownership does not transfer to a partner, even when the partner drafts the material.

Control ownership: Named owners decide how each Annex A control of ISO/IEC 42001 and each Annex A control of ISO/IEC 27001 is implemented and operated.
Policies and objectives: Leadership approves the AI policy, the information security policy and the objectives, and reviews them in management review.
AI system owners: Business and product owners answer for each AI system's purpose, data, impact assessment results and intended use.
Risk decisions: Accepting, treating or avoiding AI and information security risks is an internal decision recorded in the risk register.
Applicability justifications: Your team defends each inclusion and exclusion in the statement of applicability.

Before engaging anyone, confirm that each of these roles has a named person and that those people have time allocated for them.

What to ask an implementation partner before combining the standards

Before you sign with an implementation partner for a combined ISO/IEC 42001 and ISO/IEC 27001 program, check that the partner can scope both standards in one coherent system and that it understands where its work stops. The first test is the level of integration. Ask how the partner will document the shared elements (integrated documentation, a single management review, shared internal audits, common policy and objectives, and shared processes) and how each one will be presented to the certification body. Global ACI-TECH-3-008 ties any audit time reduction to that level of integration, and its stage 1 audit confirms the declared level, so a vague answer here will cost you later in audit time and in the credibility of the integration claim.

Next, ask who writes each statement of applicability. The ISO/IEC 42001 statement of applicability covers the 38 Annex A AI controls, and the ISO/IEC 27001 statement of applicability covers its own Annex A set. The two sets differ in subject matter, so each justification for inclusion or exclusion must come from the organization's own risk and impact decisions. A good partner drafts both documents from your AI inventory and risk register, names the owner who signs each justification, and shows where a single control, such as data quality or supplier management, is referenced in both. Confirm also how evidence is handed over: ask for the evidence index, the file structure, the retention period you will own, and the named person who answers auditor requests after the engagement ends.

Finally, ask whether the partner has any commercial, staffing or referral relationship with the certification body you plan to use, and whether any of its staff have worked as auditors for that body. DeployOpen prepares systems, controls and evidence for assessments, and it does not issue audit reports, attestations or certificates. Only the independent certification body does that. Put the independence boundary in writing in the scope document, and confirm with the certification body which forms of preparation it accepts before work starts. Ask the partner to state its role in writing, including that the organization, not the partner, owns its controls and the decisions behind them.

How DeployOpen prepares an integrated ISO 42001 and ISO 27001 evidence set

DeployOpen works on the self-hosted open-source platforms inside your own infrastructure that produce governance and security evidence for both standards. We prepare the systems, controls and records that an independent certification body will examine, but we do not issue audit reports or certificates.

How we scope

Engagements are fixed-scope, with the written scope agreeing which AI systems and ISO 27001 boundaries are covered.
We map the shared clauses 4 to 10 and record which Annex A controls from each standard apply to the integrated evidence set.
We confirm with your certification body the level of integration it expects before the scope is finalized, since audit time depends on it.

How we build

We configure one shared document set for policies, risk registers, internal audit and management review used by both standards.
We prepare separate evidence for the 38 ISO 42001 Annex A controls, including impact assessment records, and for the ISO 27001 controls.
We run security testing of applications, APIs, cloud infrastructure and AI systems so the test results can be cited as evidence.

How we hand over

You receive documentation of every system, configuration, control record and evidence source, written so your staff can maintain it.
We walk your internal owners through the evidence set so they can answer an auditor's questions without us in the room.
Your organization keeps ownership of its AI governance decisions, its statement of applicability and its management system.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover, scoped in writing.
Retainers can cover evidence refreshes ahead of surveillance audits, since the certification body decides the audit dates.
Ask any partner to confirm in writing which tasks stay with your staff, including internal audits and management review.