Direct answer: ISO/IEC 42001 and ISO 27001 share the same high-level structure, so most practice under clauses 4, 5, 7, 9 and 10 can be shared: document control, internal audit, management review, corrective action and part of supplier management. What must be added is AI-specific: AI policy, AI system inventory, AI risk assessment and AI system impact assessment, data quality, model validation and life-cycle evidence. ISO 27701 records of processing can serve as the data index for the AI system inventory, but a privacy impact assessment cannot be used directly as an AI system impact assessment.
Shared, strengthened and not interchangeable
| Category | Items |
|---|---|
| Shared | Document and record control, internal audit, management review, corrective action, training records, part of supplier management |
| Strengthened | Supplier management adds model versions, data use and change notice; the security incident process adds AI incident triage |
| New | AI policy, AI system inventory, AI risk and impact assessment, data quality and model validation, life-cycle procedures |
| Not interchangeable | Privacy impact assessment is not an AI system impact assessment (facts can be shared, content and approval cannot); an ISO 27001 certificate does not cover an AI management system |
What a consultant should deliver
- An integration gap table listing shared, strengthened and new items clause by clause
- AI-specific procedures and record formats within the shared framework
- An internal audit and management review arrangement shared by the three management systems
How to accept the work
Every "shared" item in the gap table points to an existing document; every "new" item has an owner and completion evidence; the internal audit and management review records of the three systems neither duplicate nor contradict each other.
What cannot be guaranteed
Sharing shortens the timeline, but an ISO 27001 certificate does not extend to ISO 42001; each is certified separately.
Winners Consulting's approach
The following describes Winners Consulting's own approach. Please test us with the same questions above, and test other consultants too.
- Who leads: VP- and director-level consultants guide the whole engagement, without outsourcing
- Project rhythm (as listed on our service page): scope and inventory 2–4 weeks, risk and impact assessment 3–5 weeks, system build 6–10 weeks, audit and certification 4–8 weeks; organisations that already hold ISO 27001 usually reach certification in 4–6 months, from scratch about 6–9 months
- Division of roles: we build the system and the evidence chain; legal opinions come from partner lawyers; certification is carried out by a certification body accredited under ISO/IEC 42006, which we accompany but do not stand in for
- Completed work (anonymous, under a non-disclosure agreement): an industrial automation manufacturer built an AI system inventory, completed AI risk classification, established algorithm review and human oversight for high-risk uses, and obtained ISO 42001 certification
- Named cases (published with client authorisation): ISO 27001 clients include MPI Corporation, Cho Yuan and Hypercore Fitness Center; ISO 27001 and ISO 27701 integration at Hypercore Fitness Center (Hypercore case)
- Timeline: organisations that already hold ISO 27001 usually reach ISO 42001 certification in 4–6 months
Related questions
- How long does ISO 42001 take with ISO 27001 already in place? The two share a high-level structure and most clauses can be shared; you add an AI policy, AI system inventory, AI risk and impact assessment and the AI-specific controls. Organisations with ISO 27001 usually reach certification in 4–6 months; from scratch about 6–9 months. ISO 42001 implementation
- Can a privacy impact assessment serve as the AI impact assessment? Not as a direct substitute. They can share facts, but the AI system impact assessment looks at effects on individuals, groups and society, and its content and approval must be completed separately. How to choose an ISO 27701 consultant in Taiwan
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.