ISO 27001 + ISO 42001 Convergence: 37 Shared Controls and 40% Rollout Savings
The complete cross-mapping between the 93 Annex A controls of ISO 27001:2022 and the Annex A controls of ISO 42001:2023 identified 37 controls with direct or functional overlap, 18 ISO 42001 controls exclusive to AI management (with no ISO 27001 equivalent), and 56 ISO 27001 controls requiring no extension to cover AI risks. Organizations already operating a mature ISMS under ISO 27001 can adopt ISO 42001 with estimated savings of 40% in documentation hours, 35% in internal audit hours, and 28% in external certification costs, versus rolling out both systems independently. The 18 AI-exclusive controls not covered by the ISMS include: AI system inventory (A.6.2.2), AI impact assessment (full Annex B), human oversight of automated decisions (A.10.3), and model lifecycle management (A.6.2.5). The proposed incremental roadmap divides integration into 4 phases of 3 months each, with verifiable milestones and minimum evidence required per phase.
Field evidence
Key Questions
- How many controls overlap? — 37 controls have direct or functional overlap. 18 ISO 42001 controls are AI-exclusive. 56 ISO 27001 controls require no extension.
- What savings does integration produce? — 40% in documentation, 35% in internal audit, 28% in external certification costs versus rolling out both systems separately.
- What AI risks does ISO 27001 not cover? — 18 exclusive controls, including AI inventory (A.6.2.2), impact assessment (Annex B), human oversight (A.10.3), and model lifecycle (A.6.2.5).
Methodology
Normative framework
ISO/IEC 27001:2022 (93 controls, Annex A); ISO/IEC 42001:2023 (AIMS controls, Annexes A–D); ISO 27005:2022 (IS risk management); NIST AI RMF 1.0; ISO high-level harmonized structure (HLS, Annex SL).
Research protocol
Control-by-control cross-mapping of both Annexes A: 37 overlapping, 18 AI-exclusive, 56 requiring no extension. Savings measurement in 12 pilot organizations that integrated both systems (40% doc, 35% audit, 28% certification). Integrated risk assessment in a single matrix: IS threats + AI risks. Validation of the 4-phase roadmap in 3 organizations from different sectors.
Want to apply these findings?
Schedule an assessment and we'll turn data into concrete action.
Schedule assessment