If you already hold ISO 27001, adding ISO 42001 is an extension of the system you run today, not a second one built from scratch. It usually takes roughly four to twelve months to certification, at the short end with a working 27001 system and a narrow AI scope. ISO 42001 is the certifiable standard for managing AI: the policies, roles, risk checks and records that keep the AI you build or use under control.
Clauses 4 through 10 carry over, and the new work is the AI system inventory, the AI system impact assessments and the 38 Annex A AI controls. Both standards share one management-system structure: context, leadership, planning, support, operation, performance evaluation and improvement. Your document control, internal audits, management review and corrective action all carry over. Not everything about those clauses transfers, though, because your risk method now has to cover harm to the people an AI system affects, and not only harm to information.
The first new piece is the AI system inventory: a list of every AI system you build or use, including third-party tools and AI inside your own products, with an owner, a purpose, the data it touches and the vendor. A spreadsheet is enough. In my experience it usually turns up tools that staff adopted without IT ever hearing about them. An auditor will expect it, and everything else builds on it.
The second is the AI system impact assessment, which ISO 27001 has no equivalent for. It asks what an AI system could do to the people affected by it, such as a job applicant screened by a hiring tool, and what you do about it. For each system that matters, it's a short written document with the owner, who is affected, what could go wrong and what limits the harm.
The third is Annex A, the list of AI controls in ISO 42001. It has 38 controls in nine areas, covering policy, roles, resources, impact assessment, the AI system lifecycle, data, information for interested parties, meaning what you tell customers and regulators about the AI, use of AI, and third parties. The lifecycle area means controlling how an AI system is designed, tested, changed, monitored and retired. Your 93 ISO 27001 controls don't substitute for these, although your security controls do help with some of them. You write a new Statement of Applicability, which lists each control and says whether it applies, and why.
The standard sets no duration, and published estimates vary. I'd plan on roughly four to twelve months to a certificate, toward a year if you have many AI systems and unclear ownership. Most of the effort is your own team's time building and running the AI controls before the auditor arrives. Your 27001 certificate doesn't count toward 42001, so an accredited certification body still runs a Stage 1 and a Stage 2 audit. Few auditors are qualified for 42001 so far, so ask your certification body now about its 42001 availability and Stage 1 dates, and build that wait into your plan.
As for who does both, most firms offering ISO 42001 come from information security, so they know 27001 well. Ask any of them whether they've written AI impact assessments, mapped the Annex A controls, and taken a client through a 42001 certification audit. At Certify Consulting we come from quality systems and regulated manufacturing, and we work alongside your security team and your 27001 program. Jared Clark, who leads it, is a PECB Certified ISO/IEC 42001 Lead Implementer.
We start with a fixed-fee gap assessment at $9,750. It takes two to three weeks, and you get a written report, a prioritized plan, and an estimate of the time and cost to certification. Implementation is then quoted from that gap report. The link to book a free call is in the description.
To start today, write down every AI tool your company builds or uses, with an owner next to each one. Then bring that list to your 27001 internal audit lead, or to a call with us.
