ISO/IEC 27001 protects information: its confidentiality, integrity and availability. ISO/IEC 42001 governs AI: its risks and impacts on people across the lifecycle. An agent platform needs both, because an agent can leak data, a security failure, or take a wrong action on correct data, an AI failure. Run them as one management system with two sets of criteria.
What does each standard require?
Both follow the same high-level structure: context and scope, leadership and policy, planning and risk assessment, support, operation, performance evaluation through internal audit and management review, and improvement. Both have an annex of reference controls and require you to state which apply and why.
They differ in what they protect.
ISO/IEC 27001 asks you to identify risks to information and treat them. Its controls cover access, cryptography, operations security, supplier security, incident management, secure development and similar. An attack, a misconfiguration or a careless insider are its typical threats.
ISO/IEC 42001:2023 asks you to identify risks arising from AI systems, and to assess the impact of those systems on individuals, groups and society. Its controls cover AI policy, roles, resources for AI, impact assessment, the AI lifecycle, data for AI, information for interested parties, responsible use and third-party relationships. A biased output, an ungrounded answer or an AI system used beyond its purpose are its typical concerns.
Our guide to what ISO/IEC 42001 requires of agent platforms covers the AI standard in more detail.
Who uses which?
ISO/IEC 27001 is long established and widely expected of any software or data vendor. ISO/IEC 42001 is newer and specific to organisations that develop, provide or use AI. Agent platform vendors increasingly hold both; regulated buyers increasingly ask for both. Neither is mandatory by law, though buyers and supervisors treat them as strong evidence. Our short answer to whether you need ISO/IEC 42001 to deploy agents is no, but it helps.
Where do they meet when the system is an agent that acts?
Agents make the two standards overlap more than they do for other AI, because agents hold permissions and act on systems. The same incident can be a failure under one standard, the other, or both.
- Injected text makes the agent reveal data. A security incident under ISO/IEC 27001; misuse of an AI system under ISO/IEC 42001, engaging lifecycle and monitoring controls.
- The agent holds broader permissions than it needs. An access control failure under one; authority beyond what evidence supports under the other.
- The agent takes a wrong action on correct data. Usually not a security event at all; squarely an AI risk with an impact on the person affected.
- The model provider changes its model. A supplier change to assess under one; a lifecycle change that needs re-testing under the other.
- The agent's decisions fall unevenly across groups. Outside ISO/IEC 27001; an impact and fairness concern under ISO/IEC 42001.
- Action logs are incomplete. A monitoring gap under one; under the other, you cannot evidence oversight or performance.
The third and fifth cases are the point. A platform can be secure and still have agents that act wrongly or unfairly. ISO/IEC 27001 alone will not catch that. Our answer on whether ISO/IEC 27001 covers AI agents explains the gap.
How do you run them together?
The shared structure lets you build one integrated management system with two sets of criteria.
| Requirement | Control | Evidence it leaves |
|---|---|---|
| One scope | Single scope statement naming the platform, agent runtime and connections | Integrated scope statement |
| One risk method, two lenses | Each risk assessed for security and AI impact | Risk register with both ratings |
| One inventory | Assets and AI systems listed together; each agent linked to the systems it touches | Combined inventory |
| One change process | Code, configuration, brief and source changes all reviewed and tested | Change records with security and AI sign-off |
| One supplier review | Model providers assessed for security and for AI behaviour changes | Supplier files covering both |
| One audit programme | Internal audits test both standards' criteria, with suitable auditors | Audit plans and reports |
| One management review | Security and AI performance reviewed together | Review minutes and actions |
Do not merge the impact assessment into the security risk assessment. The AI system impact assessment asks a different question, about effects on people, and auditors will look for it separately.
Ownership is the other trap. In many firms the information security manager runs ISO/IEC 27001 and nobody yet owns the AI management system. Give it a named lead, with authority to stop an agent's release when its impact assessment or tests are incomplete, even if security has already signed off.
What will a certification auditor ask of a combined system?
- Which requirements come from which standard, and how do you show both are met?
- Show us a risk assessed under both lenses.
- How does a change to an agent's brief pass through change control?
- Where is the impact assessment for this agent, distinct from its security risks?
- Who reviews model provider changes, and what happens next?
What does neither standard cover?
Neither proves that a specific agent performs correctly on your cases; that needs certification of each agent, which we explain in our guide to what it means to certify an agent. Neither is a law, so neither on its own satisfies the EU AI Act, DORA or data protection duties. And neither tells a buyer how the vendor's controls were tested in detail, which is what a SOC 2 report adds; see ISO/IEC 27001 vs SOC 2 for agent platforms. For an introduction, read what ISO/IEC 42001 is.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
If we already have ISO/IEC 27001, how much extra work is ISO/IEC 42001?
The structure, audit and review processes carry over. The new work is the AI risk method, the impact assessments, the AI-specific controls and the evidence that agents are tested and overseen.
Can one certification body audit both?
Many can, and a combined audit saves time. Check the body is accredited for each standard separately.
Which should an agent vendor get first?
Usually ISO/IEC 27001, because buyers ask for it before anything else. Plan the AI management system alongside so you do not build the security system twice.