As Australian organisations continue to adopt AI more widely, established information security requirements are increasingly being joined by new questions around AI governance, accountability, and risk.
Two international standards are particularly relevant here – ISO/IEC 27001, and ISO/IEC 42001. While both provide structured management systems for controlling organisational risk, they do address different areas. ISO/IEC 27001 is concerned with information security, while ISO/IEC 42001 focuses specifically on the responsible management of artificial intelligence.
In this article we’ll explain what each standard covers, where the key differences lie, and why organisations may increasingly need to consider both rather than choosing between them.
Two Standards, With Different Purposes
The most important distinction between the standards is relatively straightforward.
ISO/IEC 27001:2022 establishes requirements for an Information Security Management System, commonly known as an ISMS. Its purpose is to help organisations manage risks relating to the confidentiality, integrity, and availability of information.
That scope extends well beyond cyber security tools alone. An ISMS takes into account the combination of people, processes, policies, and technology required to protect information across an organisation. This may include everything from digital records and cloud systems, through to employee information and data entrusted by customers or other third parties.
ISO/IEC 42001:2023, meanwhile, establishes requirements for an Artificial Intelligence Management System, or AIMS. It is designed for organisations that develop, provide, or use AI systems, providing a structured approach to managing the risks and opportunities associated with those technologies. Its scope therefore includes areas that are specific to AI, such as governance, accountability, transparency, responsible use, risk management, and ongoing oversight.
Overall, while both are management system standards, they are managing different categories of organisational risk.
ISO/IEC 27001 – Managing Information Security
ISO/IEC 27001 is one of the most established international standards for information security management. Rather than prescribing a single collection of technologies that every organisation must implement, it requires organisations to establish a systematic approach to identifying and managing information security risks.
At the centre of the standard is the ISMS. This provides a framework for establishing information security policies and objectives, assessing risks, implementing appropriate controls, monitoring performance, and continually improving the way information security is managed. The objective is ultimately to preserve three fundamental characteristics of information – confidentiality, integrity, and availability.
For Australian organisations, this makes ISO/IEC 27001 relevant across virtually every sector. Information security risks are certainly not confined to technology companies. Financial information, intellectual property, personal information, operational data, and information provided by customers or partners all need to be protected regardless of the industry involved.
Crucially, the standard is also designed to scale. The particular risks, controls, and processes required will depend on factors such as the organisation’s size, activities, objectives, and information environment.
ISO/IEC 42001 – Managing AI Responsibly
ISO/IEC 42001 takes the management system approach into a newer area. Published in 2023, it was the world’s first international standard for AI management systems. It sets out requirements for establishing, implementing, maintaining, and continually improving an AIMS within organisations that develop, provide, or use AI.
The distinction between this and ISO/IEC 27001 is noteworthy. An AI system may certainly create information security risks, but those are only part of the picture. Organisations using AI may also need to consider how systems are governed, who is accountable for their use, how AI-related risks are assessed, whether appropriate oversight exists, and how performance is evaluated over time. Issues around transparency, reliability, data, and responsible use can all form part of the wider AI governance challenge.
ISO/IEC 42001 provides a structured framework for managing these considerations. ALC Training’s ISO/IEC 42001 curriculum, for example, covers organisational context, leadership, AI policy, risk management planning, operations, performance evaluation, internal audits, management reviews, AI controls, and continual improvement.
Ultimately, the standard therefore addresses AI as an organisational management issue, rather than treating it purely as a technical one.
Do Organisations Need Both?
ISO/IEC 27001 and ISO/IEC 42001 should not be viewed as competing standards.
An organisation could have a mature approach to information security, while still lacking an effective framework for governing its use of AI. Equally, strong AI governance obviously doesn’t remove the need to protect the information used, generated, stored, or processed by those systems.
Consider an organisation introducing an AI tool that processes customer information. ISO/IEC 27001 can help establish how that information is protected, and how associated security risks are managed. ISO/IEC 42001 addresses the wider management of the AI system itself – including how AI risks and opportunities are assessed, how responsibilities are established, and how the system is monitored and improved.
There is also considerable value in the fact that both standards take a management system approach. Each requires organisations to think systematically about areas such as context, leadership, planning, operations, performance, and continual improvement. For organisations already familiar with ISO management systems, this can make it easier to approach different areas of governance through consistent structures and processes.
The practical question is therefore not necessarily ‘Which standard do we need?’ Instead, organisations should consider the specific risks they are trying to manage. Where both sensitive information and significant AI usage are involved, the two standards can address complementary parts of the overall governance environment.
Building Capability Across Both Standards
Understanding the distinction between these two standards becomes particularly important for professionals working in governance, risk, compliance, information security, and AI implementation.
Someone responsible for an ISMS must understand the requirements associated with information security management. Professionals overseeing AI projects increasingly need equivalent knowledge of AIMS requirements, and the specific governance considerations associated with artificial intelligence.
ALC Training offers dedicated learning pathways in both areas. ISO 27001:2022 Foundation introduces the principles and requirements involved in implementing and managing an ISMS, while ISO/IEC 42001 – Foundation covers the fundamental concepts, requirements, and management approaches associated with an AIMS.
For professionals taking greater responsibility for implementation or assurance, ALC also offers Lead Implementer and Lead Auditor training for both standards. These pathways develop more advanced capabilities around establishing management systems, or evaluating their conformity through audit.
As AI becomes more deeply embedded across Australian organisations, the relationship between information security and AI governance will only become more important. ISO/IEC 27001 and ISO/IEC 42001 do approach that challenge from different directions, but they still share a common objective – giving organisations a structured way to identify risks, establish appropriate controls, and continually improve how those risks are managed. Understanding where each standard begins and ends is the first step towards deciding how they can support your organisation together.