Loading…
Loading…
ISO 27001 certification for AI products in plain English: what the standard requires, how it compares with SOC 2 and ISO 42001, and what enterprise buyers check
ISO 27001 used to be a badge that mature software vendors carried and younger ones planned for. That has changed. When large organisations buy AI today, their security teams start with a simple question: how does this vendor manage information security, and who has checked it?
In our experience, that question now arrives early in the buying process, often before the commercial conversation begins. A vendor that cannot answer it clearly rarely reaches the shortlist.
The reason is simple. AI products are not ordinary software. They handle more sensitive data, they keep records of what they learned from and what they were asked, and they sit inside decisions that matter. When an AI system is compromised, the damage can reach beyond leaked data to the decisions the business makes.
This guide explains what ISO 27001 is, how it compares with SOC 2 and the newer ISO 42001, why it matters for AI in particular, what the certification journey involves, and how to judge a vendor's security without relying on marketing claims.
A note on this guide: it is general information for technology and procurement leaders, written from our experience building and selling AI systems to security-conscious organisations. It is not legal or audit advice. For a certification decision, speak to an accredited certification body.
ISO/IEC 27001 is the international standard for an information security management system, often shortened to ISMS. An ISMS is the set of policies, people and processes an organisation uses to keep information safe.
The standard is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The current edition is ISO/IEC 27001:2022.
Certification means an independent, accredited certification body has audited that system and confirmed it meets the standard. A certificate runs for three years. The certification body returns for surveillance audits in between, and a full recertification audit follows at the end of the cycle.
That outside check is the point. Many security claims are self-declared. ISO 27001 is not, which is why buyers give it weight.
The standard does not hand you a fixed checklist. It asks you to define what the system covers, identify the information that matters, assess the risks to it and choose controls that address those risks. You then document how the controls work, monitor them and keep improving.
Annex A of the standard lists 93 reference controls. They span access management, encryption, physical security, supplier management, incident response and business continuity, among others. An organisation selects the controls its risks call for and explains why it excluded the rest.
This risk-based design is where the standard earns its credibility. It requires an organisation to understand its own threats, rather than tick boxes that may not match them.
ISO 27001 and SOC 2 are the two security frameworks enterprise buyers request most often. Vendors are regularly asked which one they have and which one matters more. The honest answer depends on who is buying.
ISO 27001 is international. Accredited certification bodies around the world certify against it, and it carries particular weight with buyers in Europe, the Middle East, India and Southeast Asia. The outcome is clear cut: an organisation is certified or it is not.
SOC 2 is a US framework from the American Institute of Certified Public Accountants (AICPA). It is not a certification. It is an attestation report, written by an independent CPA firm, describing an organisation's controls and whether they are well designed and working.
SOC 2 reports come in two types. Type 1 looks at how controls are designed at a single point in time. Type 2 looks at how they actually operated over a period, usually several months. US enterprise buyers tend to ask for Type 2.
Vendors that sell globally often pursue both. The underlying controls overlap heavily, so the second framework takes far less effort than the first. Together they take both questions off the procurement table.
Regulated sectors add their own layer. Examples include HIPAA for US healthcare, CJIS for US law enforcement data, PCI DSS for payment card data, the GDPR in the European Union and India's Digital Personal Data Protection Act. ISO 27001 is the broad foundation. Sector rules sit on top of it.
ISO 27001 predates the current generation of AI. It adapts well, though, because its risk-based approach lets an organisation reason about the risks specific to AI, not only those common to all software.
Several risks are new or sharper with AI. Training data exposure: the data used to teach a model may itself be sensitive, and so becomes a target. Model inversion: an attacker with enough access to a model tries to reconstruct the private data it learned from.
Inference data leakage is another. Inference is the moment a trained model makes a prediction or produces an answer. The questions people put to a model, and its replies, can be logged or kept where they should not be.
Then there is prompt injection, where crafted inputs trick a model into acting outside its intended purpose. And model supply chain risk, where a model, or something it depends on, was compromised before it ever reached you.
An ISO 27001 programme requires an AI company to name these risks, record them in a risk register and put a control against each one. Because the standard does not prescribe those controls, the company must do the engineering thinking itself, write it down and show it to an auditor.
The second benefit is scope. Writing down exactly what the management system covers forces questions that are easy to avoid. Which training data is in scope? Which logs of user queries? Which model files and third-party model dependencies? Answering them is itself a test of whether the product can be run securely as it grows.
In December 2023, ISO and IEC published ISO/IEC 42001, the first international management system standard written specifically for artificial intelligence. Like ISO 27001, it can be certified on its own.
The two standards cover different ground. ISO 27001 deals with information security. ISO 42001 deals with how AI is governed: bias, fairness, explainability, accountability, human oversight and the management of an AI system across its life.
They are designed to work together, not to replace each other. A buyer that cares about both security and responsible AI will look for evidence of both.
We expect ISO 42001 to appear in more procurement requirements, particularly among European buyers preparing for the EU AI Act. Vendors that build toward it early will find the transition far easier.
Organisations that already run an ISO 27001 programme have a head start. They know how to define a management system, run internal audits, handle corrective actions and improve continuously. ISO 42001 asks for the same discipline. Only the AI-specific content is new.
For an organisation starting from a modest baseline, certification is a substantial programme measured in many months, often close to a year or longer. Organisations with mature security practices move faster. The journey has five stages.
Gap analysis. The organisation compares its current security practices with the standard. The result is a clear list of what already exists, what must be built and what must be written down.
Implementation. This is where most of the work happens, and where most organisations underestimate the effort. It covers the risk assessment, the statement of applicability (the document listing which controls apply and why), security policies, access management, encryption, secure development, incident response, business continuity, supplier security and people security.
Internal audit. The organisation, or an independent consultant, checks that controls work as documented. Anything found here is fixed before the external auditor arrives.
Certification audit. An accredited certification body audits in two stages. Stage 1 reviews the documentation. Stage 2 tests whether the controls actually operate, through interviews, evidence and sampling.
Surveillance and recertification. Surveillance audits confirm the system keeps working between certifications. A full recertification audit follows every three years.
The cost combines consulting support, certification body fees and internal time from engineering and operations, which is usually the largest element. For a vendor selling to enterprises, the investment is best judged against the contracts that depend on it.
Enterprise buyers who ask for ISO 27001 want more than a certificate. The same questions come up in security reviews again and again.
What does the certificate cover? A vendor that has certified its office IT, but not the systems that run its AI product, holds a certificate that does not cover what the buyer is purchasing. Careful buyers read the scope statement and check that production AI systems, training pipelines and model files are included.
Is it current? A certificate without recent surveillance audits no longer reflects how the vendor operates today.
Which sector rules sit on top? Regulated buyers expect ISO 27001 plus the rules of their own sector, whether healthcare, payments, law enforcement or personal data.
How are training data, query logs and model files handled? These are AI-specific questions that ISO 27001 alone does not fully answer. A vendor with clear, documented answers moves through security review far faster.
How are incidents handled? Buyers look at the pattern of disclosure and remediation. A vendor that reports no incidents at all may be very mature, or may simply not be disclosing.
How are third parties managed? AI products often depend on outside model providers, cloud platforms and data processors. The buyer's own security now depends on how well the vendor manages those relationships.
The same mistakes appear often enough to be worth naming.
Certifying the wrong scope. Certifying the office network while leaving AI training and production systems outside the scope produces a certificate that does not cover the product.
Treating certification as a project. A sprint to the certificate, followed by neglect, leads straight to findings at the next surveillance audit. ISO 27001 is a system you run every day, not a deliverable you hand over.
A generic risk assessment. The risk assessment is the foundation of everything else. If it never mentions training data exposure, prompt injection or model supply chain risk, a vendor can pass an audit while leaving its real risks untouched.
Thin documentation. The standard expects policies, procedures, evidence that controls operate and records of corrective action. Controls that exist but are not documented fail the first stage of the audit.
Ignoring ISO 42001. ISO 27001 answers today's security questions. Vendors that start on AI governance alongside it will be better placed as buyer expectations rise.
The marketing page that announces a certificate is the weakest signal available. These are the stronger ones.
Ask for the certificate and the statement of applicability. A credible vendor provides both on request, often under a non-disclosure agreement. The statement of applicability reveals gaps the certificate alone hides.
Check the certification body. It should be accredited by a recognised national accreditation body, such as UKAS in the UK, ANAB in the US, NABCB in India or JAS-ANZ in Australia and New Zealand. A certificate from an unaccredited body does not carry the same weight.
Read the scope statement. It should explicitly include production AI systems, training pipelines, model files and the logging of user queries. If it covers only corporate IT, it does not cover the AI product.
Ask about the latest surveillance audit. A vendor that can discuss its findings and corrective actions openly is running a real management system.
Ask about AI governance. A credible vendor can explain how it handles bias, human oversight and accountability, and how its approach relates to ISO 42001.
Match it to your sector. ISO 27001 is broad, while your procurement requirement is usually specific. The vendor's position on your sector's rules matters at least as much as the certificate.
Ask where your data will live. For many AI uses, the strongest control is architectural. A system that runs inside your own environment keeps sensitive data under your own security programme and your own auditors.
At Aptibit, we treat security as an engineering discipline. It is designed in from the first technical conversation, not added after a contract is signed. Our products and client systems are engineered for the frameworks our buyers are audited against.
Our product, Visylix, shows what that means in practice. Visylix is an automated AI video surveillance platform that runs entirely on the buyer's own infrastructure: on premise, at the edge, in a hybrid setup, fully air-gapped or in the buyer's own cloud account. Video and AI processing never leave the building.
That design lets an organisation run Visylix inside its own ISO 27001 management system, under its own controls and its own auditors. Even Radha, the Visylix AI copilot, runs on an on-premise language model, so the questions operators ask stay inside the buyer's environment.
Visylix also provides the controls security teams look for. Every action Radha takes is recorded in an audit log, and high-impact actions always ask for confirmation. Access is governed by 46 permissions across 4 roles, with Active Directory, LDAP and passkey sign-in, and a tamper-evident audit trail.
Evidence is handled with the same care. Exports open in a self-contained player, sealed with SHA-256 at the moment they are locked, so anyone can check the footage is untouched. Faces, number plates and custom zones can be redacted on export.
In our custom AI engagements, security and compliance requirements are scoped alongside functionality from day one. Training data, query logs and model files are treated as assets to protect. AI-specific risks such as prompt injection and model supply chain risk are part of every design review.
If your organisation is weighing AI vendors against ISO 27001, or planning an AI deployment that must pass a demanding security review, our team can help. Reach us at https://aptibit.com/contact.
ISO 27001 is the international standard for an information security management system. Certification is issued by an accredited body, lasts three years and is checked by surveillance audits.
ISO 27001 and SOC 2 overlap heavily but serve different buyers: ISO 27001 internationally, SOC 2 mainly in the US. Vendors selling globally often pursue both.
ISO 42001 covers AI governance, including bias, human oversight and accountability. It is designed to work alongside ISO 27001, not replace it.
Certification is a serious, months-long programme. Its value lies in the contracts it unlocks and the discipline it builds.
The real signals are the scope statement, the accreditation of the certification body, recent surveillance audits and fit with your sector's rules.
Architecture matters as much as paperwork. AI that runs inside your own environment keeps your data under your own controls.
ISO 27001 certification is independent confirmation that an organisation runs an information security management system that meets ISO/IEC 27001:2022, the international standard for managing information security. The audit is carried out by an accredited certification body. A certificate lasts three years, with surveillance audits in between. Because an outside body checks the work, buyers trust it more than security claims a vendor makes about itself.
AI products bring risks that ordinary software does not: exposure of training data, prompt injection (crafted inputs that trick a model), attempts to reconstruct private data from a model, leakage of user queries, and compromised third-party models. An ISO 27001 programme requires a vendor to name these risks, record them and put controls against each one. For enterprise buyers, that discipline is increasingly an early question in any AI security review.
ISO 27001 is an international standard from ISO and IEC, and accredited bodies worldwide certify against it. The result is clear cut: certified or not. SOC 2 is a US framework from the AICPA. It is an attestation report written by an independent CPA firm, not a certification, and comes as Type 1 (control design at one point in time) or Type 2 (controls in operation over a period). Buyers in Europe, the Middle East, India and Southeast Asia tend to ask for ISO 27001; US buyers tend to ask for SOC 2. The controls overlap heavily, so vendors selling globally often pursue both.
ISO/IEC 42001, published in December 2023, is the first international management system standard written specifically for artificial intelligence. It covers how AI is governed: bias, fairness, explainability, accountability, human oversight and the management of AI across its life. ISO 27001 covers information security. The two are designed to work side by side, and we expect buyers, particularly in Europe under the EU AI Act, to ask for evidence of both more often.
There is no fixed timeline. An organisation starting from a modest baseline should plan for a substantial programme measured in many months, often close to a year or longer. Organisations with mature security practices move faster. The journey runs through gap analysis, implementation, internal audit, a two-stage certification audit, and then ongoing surveillance audits with full recertification every three years.
Cost depends on the size of the organisation, the complexity of the scope and how much work is done internally rather than with consultants. It has three parts: consulting support, certification body fees for the initial audit and each surveillance audit, and internal time from engineering and operations, which is usually the largest. The reliable figure comes from quotes based on your actual scope. For a vendor selling to enterprises, judge the investment against the contracts that depend on it.
In most countries ISO 27001 is not a legal requirement. Enterprise buyers, however, increasingly treat it as a procurement requirement, especially in Europe, the Middle East, India and Southeast Asia. Expect it in security questionnaires and tenders. Buyers in regulated sectors such as banking, healthcare, government and defence usually expect it alongside the rules of their own sector.
Ask for the certificate and the statement of applicability, the document listing which controls apply and why. Check that the certification body is accredited. Read the scope statement: it should include the production AI systems, not only office IT. Ask about the latest surveillance audit and what was corrected afterwards. Then check the vendor against your own sector rules and its approach to AI governance. A vendor that discusses audit findings openly is running a real management system; a vendor that offers only a marketing page is not.
Yes, but the vendor must demonstrate its security in other ways, which is usually harder. Some rely on a SOC 2 Type 2 report backed by clear security documentation. Others reduce the question through architecture: an AI system that runs entirely inside the buyer's own environment operates under the buyer's own security programme and auditors. Outside the US, though, buyers often do not treat SOC 2 as a substitute for ISO 27001, so vendors selling internationally should expect the question.
No. That is why ISO 42001 exists as a separate standard. ISO 27001 covers information security, including security risks that AI sharpens, such as training data exposure and prompt injection. It does not address bias, fairness, explainability, accountability or human oversight. Those belong to ISO 42001, which is designed to sit alongside ISO 27001 rather than replace it.