From security to intelligence: Integrating ISO 27001 and ISO 42001 in practice

For many organisations, ISO 27001 is already well established.

Information security management systems are in place. Risks are defined. Controls are operating. Audits are part of the rhythm of the business.

At the same time, artificial intelligence is being introduced rapidly, often without the same level of structure.

Tools like Microsoft Copilot, ChatGPT and other generative AI platforms are already embedded into day-to-day operations. Customer-facing AI features are being rolled out. Decision-making is increasingly supported by machine-driven outputs.

The challenge is clear: how do you extend an existing ISO 27001 environment to properly govern AI?

This session explores the practical integration of ISO 27001 (Information Security Management Systems) and ISO 42001 (Artificial Intelligence Management Systems), focusing on how organisations can build on what they already have, rather than starting again.

ISO 42001 is not a replacement for ISO 27001. It is an extension. Where ISO 27001 focuses on protecting information, ISO 42001 introduces additional layers of governance around how AI systems are designed, deployed and used, including considerations of transparency, accountability, bias, misuse and broader impact.

The session will begin by unpacking how organisations typically interact with AI. Most organisations operate across multiple roles simultaneously; as AI providers, producers and users. Understanding these roles is critical, as they define the organisation’s responsibilities and risk exposure.

From there, the presentation will explore how existing ISO 27001 components can be leveraged and extended to support AI governance. This includes:

• expanding risk management processes to incorporate AI-specific risks and opportunities
• extending incident management frameworks to address AI-related failures and misuse scenarios
• adapting existing controls to account for AI data usage, model behaviour and system dependencies
• incorporating AI into business continuity and resilience planning

A central focus of the session will be AI impact assessments, as outlined in ISO 42005. These assessments provide a structured way to evaluate how AI systems operate, the data they rely on, potential failure points, and both organisational and societal impacts. The session will break down how these can be integrated into existing governance processes without creating unnecessary complexity.

Importantly, the presentation will address a key misconception: that AI governance requires a completely new system. In practice, organisations that succeed are those that:

• leverage their existing ISO 27001 framework
• extend it in a targeted and structured way
• avoid duplicating processes or creating parallel systems

The session will also highlight the differences in approach between the two standards (particularly the more prescriptive nature of ISO 42001) and what this means for documentation, accountability and audit readiness.

Ultimately, this session is about helping organisations move from fragmented, reactive AI governance to a more integrated, operational model, where security, risk and AI are managed as part of a single, coherent system.