ISO 27001 and ISO 42001 together
Both standards share the same management system clauses. We build them once and add both sets of Annex A controls, so you run one system and sit one combined audit.
What you get
One system, documented once, kept in your client portal.
- 01One scope covering information security and your AI systems
- 02Shared policy, roles, objectives and risk method (clauses 4 to 10, written once)
- 03An information security risk assessment and a risk and impact assessment for your AI systems
- 04A Statement of Applicability for ISO 27001 and the Annex A controls of ISO 42001
- 05Procedures that serve both standards, and evidence against every control
- 06One internal audit, one management review, and the handover for a combined audit
How it runs
- Phase 1
Scope
Map what you already hold for each standard and agree one scope.
- Phase 2
Shared clauses
Policy, roles, objectives and risk method, written once for both.
- Phase 3
Controls
Both sets of Annex A controls, mapped to one set of procedures.
- Phase 4
Evidence and audit
Evidence, internal audit, management review and the handover to your certification body.
Quoted on request
We read your scope first, then quote a fixed price. Create an account and we pick it up in your portal.
Before you order
Is it cheaper than two engagements?
Usually. The shared clauses are written once, so the quote is lower than two separate engagements.
Can the audits be combined?
Most accredited certification bodies offer a combined audit for both standards. You choose and contract them.
Start with the free readiness check
Ten minutes. A gap report you can keep.