ISO 42001
Add ISO 42001 to the ISMS you already have
You work with AI. Record the AI you develop or use, who is responsible and how you assess risks and impact. Reuse your ISO 27001 setup where it fits.
Hosted in the Netherlands. Your data stays in the EU.In brief
- AI systems
- Recorded in scopeDeveloped, provided or used
- Roles
- An owner per systemWho is responsible for what
- Risk and impact
- AssessedWith the controls and evidence needed
- Reuse
- Assessed per controlPolicy, documents, audits and improvement
01 / Approach
From setup
to execution
A practical approach for adding an AI management system to your ISMS. You reuse what fits and add what is new.
- 01Record AI systems and roles
Describe the AI within your scope and who is responsible for what.
- 02Assess risks and impact
Assess the effects of your AI and determine the controls and evidence needed.
- 03Use your existing setup
Reuse suitable processes for policy, document management, audits and improvement.
- 04Add AI-specific work
Organise areas such as data management, testing, oversight and evaluation within your scope.
02 / One control library
ISO 42001 and ISO 27001
on a shared foundation
Shared processes can be linked to multiple standards. Check for each standard that scope, content and evidence are suitable.
See where each control counts. And where it does not
| Control | ISO 42001 | ISO 27001 | NIS2 | GDPR |
|---|---|---|---|---|
| Risk assessment | ||||
| Supplier management | ||||
| Documented information | ||||
| Internal audit & management review | ||||
| Access control | ||||
| AI impact assessment |
Check per organisation whether the control and evidence are adequate. According to Basenorm’s published mapping, ISO 27001 and NIS2 share 70 to 80% of their controls, so the next standard starts mostly complete.
03 / Next steps
Where to go next
ISO 42001 in Basenorm
Clauses, Annex A controls and how they work in the platform.
02What you can reuse from ISO 27001
Our article on what carries over and what is genuinely new.
03Combine multiple standards
Add NIS2, DORA or the EU AI Act on the same control library.
04No ISMS yet? Start with ISO 27001
The approach for your first management system, with room for ISO 42001.
04 / Questions
Questions about
adding ISO 42001
Do we need ISO 27001 before ISO 42001?
No. You can start with ISO 42001 without an ISO 27001 certificate. If you already have a management system, you can reuse suitable processes and evidence. Assess what your AI scope requires for each part.
Does ISO 42001 certification mean we comply with the EU AI Act?
No. ISO 42001 is a voluntary standard and not a harmonised standard under the AI Act, so certification does not give a presumption of conformity. The management system does help you organise and evidence your obligations.
What does AI do, and what do we review ourselves?
AI helps identify and pre-check evidence. Agents and integrations can carry out tasks within the available permissions and configured workflow. You define who reviews results and which decisions need approval.
Does Basenorm issue our certificate?
No. Basenorm supports setting up and evidencing your management system. An independent certification body conducts the certification audit and decides whether to issue a certificate.
Start with your own question
Show us where you are, and we will show you what is possible
Your first standard, a move from another tool, or AI governance. We tailor the demo to your situation.
- Which existing processes you can reuse.
- What you need to add for your AI systems.
- How you manage controls and evidence together.
Hosted in the Netherlands. Your data stays in the EU.