Software and AI vendors
Anyone whose customers send a security questionnaire. An ISMS is the answer most expect, and a certificate ends the questionnaire.
WHO IT APPLIES TO
Who adopts ISO/IEC 27001
Nobody has to adopt it. These are the organisations already being asked the question it answers.
Processors under the GDPR
Art. 28 and Art. 32 ask a processor to show appropriate technical and organisational measures; an ISMS is the usual evidence.
Providers of high-risk AI
EU AI Act Art. 15 asks for accuracy, robustness and cybersecurity across the lifecycle; Annex A's technological controls organise that work.
KEY DATES · STATUS
The dates that matter
Voluntary. The certificate comes from an accredited certification body, never from Veritome (ISO/IEC 17021-1 §5.2.5 keeps the consultant and the certifier apart).
| Date | Event | What it means |
|---|---|---|
| 25.10.2022 | 2022 edition published | Replaced the 2013 edition; Annex A was restructured into four themes. |
| 31.10.2025 | Transition ended | Certificates to the 2013 edition ceased to be valid; every current certificate is to the 2022 edition. |
| 18.12.2023 | ISO/IEC 42001 published | Shares the Annex SL clause structure, which is why Veritome runs the two as one system. |
WHAT IT ASKS
118 requirements, in the shape the framework gives them
Clauses 4 to 10 set out the management system; Annex A lists 93 controls, each decided, justified and evidenced in the Statement of Applicability. Veritome names them; the licensed text is never reproduced.
25
clause requirements (clauses 4 to 10)
93
Annex A controls
- Clause 4Context of the organisation4
- Clause 5Leadership3
- Clause 6Planning5
- Clause 7Support5
- Clause 8Operation3
- Clause 9Performance evaluation3
- Clause 10Improvement2
- A.5Organisational controls37
- A.6People controls8
- A.7Physical controls14
- A.8Technological controls34
HOW VERITOME RUNS IT
25 steps, 6 phases, one record each
6 phases, gate-locked in order. Each control is evidenced where the work happens, not in 93 separate forms.
- 14 of the 25 steps are the same record as in ISO/IEC 42001: one form, and approving it re-plans the sibling.
- Operate groups the controls into organisational, people, physical and technological themes, plus continuity and incident management.
- The Statement of Applicability is generated from those records.
WHERE IT OVERLAPS
Credited in both, or only related
The 14 records shared with ISO/IEC 42001 are credited in both, checked against both standards in the owner-verified matrix. Links to other frameworks are related: supporting reading, never coverage.
ISO 27001Establish4.1
Context of the organisationDone
Also counts toward ISO 42001Credited by work already on file
Across the programme
14 credited · 18 related
17 related
11 related
7 related
Write it once, credited where it counts
Illustrative progress · the steps and counts are the product’s
ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF cross-mapping lands with the full launch, planned for late November 2026.
10 of the 25 steps carry a related link to an EU AI Act article. A related link was not checked against source text by the owner's verified matrix, so it is shown and never counted. Credit shows in three places only:
- “Also counts toward” on a record
- “Credited by work already on file” on a step that is Done
- one figure on each programme card
See all three on the frameworks page, and the EU AI Act article by article at /eu-ai-act.
| With | Records credited in both | Related only: shown, never credited | Page |
|---|---|---|---|
| EU AI Act | 0 | 17 | EU AI Act → |
| GDPR | 0 | 11 | GDPR → |
| ISO 42001 | 14 | 18 | ISO 42001 → |
| NIST AI RMF | 0 | 7 | NIST AI RMF → |
QUESTIONS PEOPLE ASK
ISO/IEC 27001, answered plainly
The same answers, word for word, that the page marks up for search engines and AI assistants.
What is ISO/IEC 27001?
The international standard for an information security management system (ISMS), published by ISO and IEC; the current edition is 2022. It specifies how an organisation scopes, risk-assesses, controls and continually improves its information security, and an accredited body can certify it.
Why does an AI company need ISO/IEC 27001?
Because its customers ask, and three regimes point at the same work: GDPR Art. 32 asks for security appropriate to the risk, EU AI Act Art. 15 asks high-risk providers for cybersecurity across the lifecycle, and ISO/IEC 42001 assumes the security clauses are already answered. One ISMS is the evidence for all three.
How many controls are in ISO/IEC 27001:2022?
93 Annex A controls in four themes (organisational, people, physical and technological), beside 25 clause requirements in clauses 4 to 10. Veritome's catalogue carries all 118.
What changed between the 2013 and 2022 editions?
Annex A went from 114 controls in fourteen domains to 93 in four themes, with eleven new controls covering threat intelligence, cloud services, ICT readiness for continuity, physical monitoring, configuration, information deletion, data masking, data-leakage prevention, monitoring, web filtering and secure coding. Clauses 4 to 10 changed little. Certificates to the 2013 edition ceased to be valid on 31.10.2025.
Can I run ISO/IEC 27001 and ISO/IEC 42001 together?
Yes. Both follow the Annex SL clause structure, so context, leadership, support and evaluation are one set of records. Veritome runs them as one management system with two scopes: 14 of the 25 steps here are shared with the ISO/IEC 42001 programme.
Does Veritome certify ISO/IEC 27001?
No. An accredited certification body audits and certifies; ISO/IEC 17021-1 keeps the party that helped build the ISMS apart from the one that certifies it. Veritome runs the programme, generates the Statement of Applicability and holds the evidence the auditor asks for.
The other four