How AI changes your ISO 27001 certification requirements

Your organisation holds an ISO 27001 certificate. You've also rolled out Copilot, integrated an AI coding assistant into your dev pipeline, or deployed a chatbot that's processing customer data. Here's the question almost nobody is asking: have you updated your ISMS to reflect any of it?

We audit across both ISO 27001 and ISO 42001 (the new international standard for AI management systems), and we're seeing the same gap everywhere. Organisations are adopting AI fast and governing it slow. Most security teams treat AI tools as just another piece of software. But AI introduces risk categories that traditional 27001 scoping wasn't built for: training data provenance, model drift, automated decisions affecting real people, third-party AI services where you've got limited visibility into how your data is being used, and outputs that can't be fully predicted or reproduced.

These aren't theoretical problems. They're the kinds of issues that will surface in your next surveillance audit if your auditor is paying attention. And if they're not paying attention, that's a different problem entirely.

This session walks through what AI adoption actually means for your 27001 certification, from someone who sits in the auditor's chair and sees what's really happening across dozens of certified organisations.

We'll cover four areas.

First, AI as a new asset class in your ISMS. How to identify, classify, and manage AI systems as information assets, including where AI tools create data flows that sit outside your current scope boundary.

Second, existing Annex A controls that already apply to AI but are being missed. Controls like A.5.21 (ICT supply chain), A.8.28 (secure coding), and A.8.10 (information deletion) have direct relevance to AI deployments. Most organisations haven't mapped them.

Third, where 27001 stops being enough. There's a threshold where stretching your ISMS to cover AI governance creates more risk than it solves. We'll talk about when ISO 42001 makes sense as a companion certification, what it actually requires, and how the two frameworks talk to each other.

Fourth, what you can do right now. Before your next audit, there are practical steps your team can take to close the AI governance gap without overhauling your entire management system.

This isn't a talk about AI hype or governance theory. It's a practical briefing from people who do this every day. We'll share real patterns we're seeing (anonymised, obviously), common mistakes, and the specific questions your auditor is likely to start asking in the next 12 months.

Whether you're a CISO, a security manager, or the person who drew the short straw and ended up responsible for maintaining your 27001 cert, you'll leave with a clear picture of what needs to change and a practical roadmap for getting there before your auditor does. Because the organisations that figure this out now will be ahead of the curve. The ones that don't will be explaining it in a corrective action plan.