The EU-native platform for security and AI teams
ISO 42001 and ISO 27001.
Together in one EU-native platform.
Extend your existing management system with AI governance. Reuse controls and evidence, see what needs adding and keep oversight with Basenorm.
Hosted in the Netherlands. Your data stays in the EU.Reuse the way you already work.
You start with what is already in place.
Your ISO 27001 processes are the starting point for extending to AI.
| Process | Status | Standard |
|---|---|---|
| Existing | 27001 | |
| Existing | 27001 | |
| Existing | 27001 | |
| Existing | 27001 |
Click a row to see the explanation and the example evidence.
The demo uses fixed example data.
Reuse what fits. Manage shared processes in one place.
See what needs adding. Make the AI additions concrete.
Show the evidence. Link controls to evidence.
01 / Approach
What is in place.
What needs
adding.
Your policies, responsibilities and audit cycle are a starting point. ISO 42001 and ISO 27001 share the same structure for clauses 4 to 10. Build on that and add what you need for AI.
Choose your starting pointShared processes.
Managed once.
Check per standard whether your existing control and evidence are adequate.
02 / Unified Control Framework
One control.
Multiple
standards.
In the Unified Control Library you define a control once and link the evidence once. Basenorm shows which standards that control counts for. Start with ISO 42001 and ISO 27001 and add other standards later.
About the Unified Control LibrarySee where each control counts. And where it does not.
| Control | ISO 42001 | ISO 27001 | NIS2 | GDPR |
|---|---|---|---|---|
| Risk assessment | ||||
| Supplier management | ||||
| Documented information | ||||
| Internal audit & management review | ||||
| Access control | ||||
| AI impact assessment |
Check per organisation whether the control and evidence are adequate. ISO 27001 and NIS2 share 70 to 80% of their controls, so the next standard starts mostly complete.
03 / Platform
Norman,
what next?
Ask about your controls, risks and evidence. In Basenorm, or from a supported AI assistant via MCP.
What do we still need to arrange for ISO 42001?
You can build on your existing ISO 27001 processes. In this example, these AI items still need attention:
Via MCP you work from a supported AI assistant, such as ChatGPT or Claude.
You use the relationships between controls, risks, evidence and owners.
You assess the outcome and decide which changes to make.
This example shows fixed answers.
04 / The AI Act
REGULATION (EU) 2024/1689ISO 42001 and
the AI Act.
ISO 42001 is a management system. The AI Act is the law. ISO 42001 does not make you AI Act compliant on its own, but it gives you the structure to organise and evidence your obligations.
prEN 18286 expected. Target date for the harmonised standard for the quality management system.
High-risk AI, Annex III. Obligations start to apply for most high-risk systems.
High-risk AI, Annex I. Obligations for AI in products covered by sectoral legislation.
A management system, not a law. ISO 42001 covers policy, roles, AI risk and impact assessment, and controls that an accredited body can certify.
No presumption of conformity. ISO 42001 is not a harmonised standard under the AI Act. Certification alone therefore does not give a legal presumption of conformity.
Work that carries over. prEN 18286, the upcoming harmonised standard for the quality management system under the AI Act, maps to the Annex A controls of ISO 42001.
Dates according to Regulation (EU) 2024/1689 as amended by the Digital Omnibus. The prEN 18286 date is a CEN-CENELEC target date.
05 / Security
Your auditor will ask how
we protect your data.
Hosted in the EU.
Based and hosted in the Netherlands, on EU infrastructure. Every customer gets a data processing agreement.
Encrypted and separated.
End-to-end encrypted. Each organisation’s data stays separated in a multi-tenant environment.
Access under control.
SSO and MFA, with roles for owner, admin, user and auditor. Least privilege by default.
Everything traceable.
Every action is recorded in an immutable audit trail, exportable for external audits.
Your starting point
Where do you stand?
06 / Questions
Good
to know.
What is Basenorm?
Basenorm is an EU-native platform for ISO 42001 and ISO 27001. You run your AI management system and your ISMS on one control library: shared controls and evidence are maintained once, and AI-specific requirements are added where they are needed. Basenorm is based and hosted in the Netherlands.
Do we need ISO 27001 first?
No. You can also build your first information security management system with Basenorm. The setup gives you a base that you can later extend with AI governance.
How much can we reuse for ISO 42001?
That depends on your scope, AI use cases and existing setup. Think of document control, responsibilities, internal audits and improvement actions. For each part you assess whether the content also works for AI. A fixed overlap percentage would oversimplify that assessment.
Which topics do we add for AI?
Among other things, you record your AI systems and their intended use. You assess AI risks and potential impact, set up data management and human oversight, and organise testing and monitoring. What exactly you need depends on your role and scope.
How does ISO 42001 relate to the EU AI Act?
ISO 42001 is not a harmonised standard under the AI Act, so certification alone does not give a presumption of conformity. It does give you the management system to organise and evidence your obligations, and the upcoming harmonised standard prEN 18286 maps to the controls of ISO 42001.
What does MCP mean for our team?
MCP stands for Model Context Protocol. It lets a supported AI assistant retrieve information from Basenorm through the available tools. Which information and actions are accessible depends on your permissions and how the connection is set up.
Where is our data stored?
Basenorm is based and hosted in the Netherlands. All customer data stays on EU infrastructure and every customer receives a data processing agreement.
Does Basenorm certify our organisation?
Basenorm supports setting up, managing and demonstrating your management system. An independent certification body performs the certification audit and decides on the certificate.
Book a demo
See ISO 42001 in your own context.
Together we look at where you stand today and what your next step is.
- Which existing processes you can reuse.
- What you need to add for your AI systems.
- How you manage controls and evidence together.
Hosted in the Netherlands. Your data stays in the EU.