The standards and rules ISO 42001 works with: the ISO/IEC AI standards family, ISO/IEC 23894 risk guidance, ISO/IEC 27090 AI security guidance, and GDPR and privacy requirements for AI systems that process personal data.
A buyer's map of the ISO/IEC AI standards that surround ISO 42001: terminology in ISO/IEC 22989, risk guidance in ISO/IEC 23894, impact assessment in ISO/IEC 42005, certification body rules in ISO/IEC 42006, life cycle, data and logging standards, and which ones can be certified.
How ISO/IEC 42001 and ISO/IEC 23894 differ and fit together: certifiable requirements versus risk management guidance, where 23894 helps with AI risk assessment and treatment clauses, and the NIST crosswalks that map both.
How ISO/IEC 27090:2026 on security threats to AI systems complements ISO 42001 and ISO 27001: threats such as data poisoning and model theft, verification and validation, monitoring and supplier controls, and the AI security testing that produces evidence.
How ISO 42001 work lines up with GDPR for AI that uses personal data: DPIAs, automated decision-making rights, data acquisition and provenance controls, the EU AI Act fundamental rights impact assessment that complements a DPIA, and privacy standards ISO 27701 and 27091.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.