We only use AI bought from vendors. Does the CISO still need ISO 42001?
ISO/IEC 42001 applies to organisations that provide or use AI products and services, not only those that train models. If you only use purchased generative AI, the scope centres on use: which departments, which AI tools, what data, who approves, and who is responsible when something goes wrong.
Whether to certify depends on whether customers or markets ask for proof of AI governance. If internal AI is used in high-risk settings such as HR decisions or credit assessment, a governance framework is recommended even without external sales. With several legal entities, start with one business group or entity as the first certification scope, and keep the certificate scope consistent with what you tell customers.
Employees use generative AI on customer data. How should the CISO control this?
First separate the evidence you control: usage records, approvals, training and output review are yours; model training data and testing can mostly only be requested from suppliers. In practice:
- AI system inventory: purpose, using department, data categories, supplier, approver
- Usage rules and review of data inputs and outputs
- Supplier management extended to model versions, data use and change notifications
If an automotive supplier uses AI tools on customers' confidential or prototype data, those processes fall within the information security management assessed by TISAX, and AI tool use must be controlled.
We already have ISO 27001 and 27701. What evidence can be shared, and what must be added?
42001 shares the high-level structure of 27001:
| Category | Items |
|---|---|
| Shared | Document and record control, internal audit, management review, corrective action, training records, part of supplier management |
| Strengthened | Supplier management adds model versions, data use and change notification; the incident process adds AI incident triage |
| New | AI policy, AI system inventory, AI risk and impact assessment, data quality and model verification, lifecycle procedures |
A privacy impact assessment cannot be used directly as an AI system impact assessment, and a 27001 certificate does not cover an AI management system; each is certified separately.
Once we hold ISO 42001, are we compliant with the EU AI Act?
No. ISO/IEC 42001:2023 certificates are issued by certification bodies accredited under ISO/IEC 42006; but EU AI Act conformity assessment, EU database registration, an authorised representative and Article 50 transparency remain legal procedures a certificate cannot replace, and 42001 gives no presumption of conformity.
Dates as amended by Regulation (EU) 2026/1744:
- Article 50 transparency obligations have applied since 2 August 2026
- Annex III high-risk AI systems from 2 December 2027
- Annex I AI embedded in regulated products from 2 August 2028
If users are in the EU, a Taiwanese company must comply.
When AI goes wrong, how should the CISO adjust the incident response procedure?
AI incidents can share the security incident process, but they often involve no intrusion; the cause lies in data, the model or use, so triage rules must recognise them and assign investigation. A common failure: after an AI gives a wrong recommendation, R&D blames use, sales blames the model, security says there was no intrusion, and nobody investigates.
Recommended mechanisms: AI incident triage rules, evidence preservation, root cause investigation, internal and external communication, correction and effectiveness verification. Whether an event is legally reportable depends on the applicable law and is for legal counsel to determine case by case.
How should budget and timeline be planned, and how does the CISO report to the board?
Listed on the service page: organisations with ISO 27001 usually reach certification in 4–6 months, about 6–9 months from scratch.
| Phase | Timeline |
|---|---|
| Scope and inventory | 2–4 weeks |
| Risk and impact assessment | 3–5 weeks |
| System build | 6–10 weeks |
| Audit and certification | 4–8 weeks |
All 38 Annex A controls are implemented with evidence. Listed companies report regularly on cybersecurity to the board or management under Article 37 of the TWSE and TPEx Cybersecurity Control Guidelines for Listed Companies; the AI system inventory, risk classification and management review results can be folded into that existing report. Companies that are not public companies are not covered by these guidelines and can use them voluntarily.
How does Winners Consulting help a CISO with ISO 42001?
Winners Consulting's approach (test us with the questions above too):
- VP- and director-level consultants lead in person; nothing is outsourced
- We first clarify markets, the proof customers want and the internal risks to control, then recommend 42001 alone, in sequence, or with the AI Act
- 42001 as the base, sharing its structure with ISO 27001/27701, with an integration gap table
- Legal opinions come from partner lawyers; certification is by a body accredited under ISO/IEC 42006, and we accompany without auditing on its behalf
ISO 42001 consulting, 42001 with 27001 and 27701, AI incidents after deployment. Apply for a free mechanism diagnosis
How other roles see this service
- CEOEU AI Act and ISO 42001 for the CEO: staff AI use, fines and governance ownership
- CROAI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- CTOISO 42001 and the EU AI Act for CTOs: what does AI product development need?
- Product managerISO 42001 for product managers: how do we answer customer demands on AI product governance?
Other services for this role
- CISO implementing ISO 27001: board reporting, the ESG bonus point and certification scope
- CISO on ISO 27701 and GDPR: cross-border data, employee data and the 72-hour notice
- CISO facing NIS2: are we in scope, and how to handle several EU countries, the board and reporting?
- CISO facing DORA: serving EU financial clients, what to prepare for contracts, reporting and testing
- CISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CISO implementing ISO/IEC 29147: reporting channel, CVD policy and CRA reporting
- CISO guide to ISO/IEC 30111: linking vulnerability handling to CRA reporting
- CISO guide to IEC 62443: which parts to pursue and how it relates to the EU CRA
- CISO guide to TISAX: assessment level, ISA2027 and timeline
- CISO guide to ISO/SAE 21434: product security beyond TISAX
- CISO guide to ISO 22301: ICT recovery, RTO and exercises
- CISO and the EU AI Act: what do AI security, logs and human oversight require?
- CISO and trade secret protection: designing classification and access logs that hold up