Model Online / On-Site
Duration
Modules 5 modules

Course Objective & Scope

Organisations that already run an ISO/IEC 27001 Information Security Management System (ISMS) waste time and create audit fatigue if they build a separate document hierarchy, committee and audit cycle from scratch for ISO/IEC 42001. Because both standards share ISO's Harmonized Structure (Clauses 4–10), they can be tightly integrated into a single management system.

This course covers merging shared clauses, extending the ISMS risk methodology to incorporate AI risks and system impact assessments, cross-mapping ISO 27001:2022 Annex A with ISO 42001 Annex A, and running combined audits and management reviews. Participants produce an ISMS–AIMS Integration Blueprint mapped to their existing controls.

Who Should Attend?

  • ISO/IEC 27001 ISMS managers, CISO teams and information security officers
  • Integrated Management System (IMS) and quality management leads
  • Compliance and governance managers seeking a low-friction path to ISO/IEC 42001
  • Internal auditors and management system specialists

Key Takeaways

  • Map shared Clauses 4–10 against the AI-specific requirements unique to ISO/IEC 42001
  • Extend an existing ISMS risk register to cover AI risk assessments and system impact assessments
  • Cross-map ISO 27001:2022 Annex A and ISO 42001 Annex A into an integrated Statement of Applicability
  • Upgrade existing supplier management, change control and incident response processes for AI
  • Run unified internal audits and management reviews across both standards

Curriculum

Harmonized Structure (Clauses 4–10): Shared Backbone vs AI-Specific Additions
  • Reusing 100% of document control, competence, internal audit, management review and CAPA processes
  • Scope alignment options: identical scope versus AIMS as a focused subset of the ISMS
  • Synergies with ISO/IEC 27701 (Privacy Information Management)
Extending Risk Management Beyond Confidentiality, Integrity and Availability
  • Adding fairness, transparency, safety and human oversight to traditional CIA security dimensions
  • Plugging Clause 6.1.4 AI System Impact Assessment into the enterprise risk workflow
  • Unifying asset inventories across information assets, models, datasets and prompts
Annex A Crosswalk: ISO/IEC 27001:2022 ↔ ISO/IEC 42001
  • Overlapping domains: policies, supplier relationships, change control, logging and incident handling
  • Net-new ISO 42001 domains: A.5 Impact Assessment, A.6 AI Lifecycle, A.7 Data for AI, A.8 Disclosures, A.9 Responsible Use
  • Designing an Integrated Statement of Applicability (SoA)
Upgrading Existing ISMS Procedures for AI Systems
  • Extending Secure SDLC procedures to cover model/prompt validation, RAG permissions and TEVV
  • Expanding incident response playbooks to cover hallucinations, drift and adversarial AI attacks
Workshop: Delta Implementation Roadmap and Combined Audits
  • Structuring a combined internal audit schedule and unified management review agenda
  • Building a delta-implementation checklist for ISO 27001-certified organisations

Other Courses in This Category

  • ISO/IEC 42005 AI System Impact Assessment and FRIA Practice

    Conduct structured AI System Impact Assessments under ISO/IEC 42005 and EU AI Act Article 27 (FRIA), evaluate harms to individuals and society, and produce auditable impact assessment reports.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Governing Generative AI Risks with NIST AI RMF and NIST AI 600-1

    Apply the NIST AI 600-1 Generative AI Profile on top of the NIST AI RMF to govern the 12 core generative AI risks—including confabulation, data privacy, IP, cyberattacks and value-chain dependencies.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Shadow AI Discovery, SaaS AI Controls and Safe Enablement

    Discover and govern Shadow AI—unapproved web LLMs, browser extensions and silently enabled AI features inside existing SaaS tools—using CASB/DLP controls, SaaS opt-out reviews and safe internal alternatives.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Responsible AI Principles and Operational Practice

    Translate fairness, transparency, accountability, privacy, safety and human agency from abstract commitments into practical checklists across AI design, procurement and daily business operations.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • AI Ethics, Safety and Security Risk Awareness for Leaders

    Understand ethical harms such as manipulation and deepfakes alongside AI safety and security threats—prompt injection, jailbreaks, data poisoning and OWASP LLM Top 10—and govern guardrails and red teaming.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Enterprise AI Governance Framework and Operating Mechanisms

    Build an enterprise AI governance framework that scales innovation safely: establish an AI system inventory, run risk-proportionate stage-gates across the lifecycle, and report risk and value to the board.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View

Get in touch