ISO 27001 vs ISO 42001: which certificate goes on this RFQ

This page is a buying comparison. It is for operations, quality, IT, compliance, and AI leads at mid-market manufacturers and professional-services firms who are about to send a registrar RFQ and cannot agree whether ISO/IEC 27001 or ISO/IEC 42001 belongs on it.

Those standards are not interchangeable logos. 27001 is an information security management system (ISMS). 42001 is an artificial intelligence management system (AIMS). Customers ask about both. Salespeople will offer to quote both. The useful question is a procurement question: which certificate does this cycle have to produce, and can you staff the system behind it.

The multi-year sequence is the 9001 → 27001 → 42001 path. The earlier fork, quality versus security on this RFQ, is ISO 9001 vs ISO 27001. Whether the system is real enough to book Stage 1 is first ISO certification. After you pick the standard, you still write one outbound pack, choose a registrar, read the quote, and verify accreditation for the legal entity and the edition you will claim. This page does not invent prices, day-rate totals, or accreditation identifiers.

The decision here is narrower: 27001 on this RFQ, 42001 on this RFQ, or neither until the system exists. Then one pack. When the other artifact is a NIST AI Risk Management Framework profile, that buying comparison is ISO 42001 vs NIST AI RMF.

1. What each standard is for, in plain terms

Skip the clause lists. Buyers do not award a certificate because they memorized a table of contents.

ISO/IEC 27001 asks whether you can protect information in a defined scope and prove it. A certification body samples that information security system: what is in scope, how you treat risk, and whether the controls you claim actually run. Buyers meet this as a Statement of Applicability: which controls apply here, and why the others do not. A policy folder, a penetration test, or a SOC 2 report is not that system. If the live fork is the certificate versus that report, use ISO 27001 vs SOC 2. If the live fork is a NIST CSF profile versus the certificate, use ISO 27001 vs NIST CSF. If the live fork is a privacy certificate (ISO/IEC 27701) versus the information-security certificate, use ISO 27001 vs ISO 27701.

For a software-enabled manufacturer the ISMS often lives at headquarters, a development office, and a cloud estate the factory certificate never named. For a professional-services firm it is client data, access, suppliers, and incidents. The owner is whoever can walk those facts.

ISO/IEC 42001 asks whether you can govern the AI systems you develop, provide, or use, and prove that governance. A certification body samples that AI management system: which systems are in scope, how you assess AI risk and impact, who may approve a system, how the lifecycle runs from data and deployment through monitoring and retirement, and how you treat third-party and general-purpose models. The certificate records that system. It does not promise that a model is accurate, fair, or lawful in every jurisdiction. A copilot note is not an AIMS. An ISMS with "AI" typed on the cover is not one either.

On a plant, the AIMS is often one vision cell, a scheduling model, or a narrow set of tools that now do production work, plus the people who approve them. In a professional-services firm it is the models embedded in delivery. A chatbot someone tried once is a different object. The owner is whoever can show the inventory and the approval record. The security manager is that person only when they actually own those decisions.

You can hold both certificates eventually. This page is about which one this RFQ is for.

2. When 27001 is the rational certificate this cycle

Start with 27001 when the pressure in front of you is information security, and an AIMS mark will not lose a bid this quarter.

That is the usual case once quality is already settled, or was never the gate. Enterprise vendor-risk queues, insurers, and customer security exhibits still name an ISMS. The AI conversation in the same room is often a forecast: a questionnaire you expect next year, a board slide, a customer roadmap, a pilot on one line that nobody has scored yet. The Statement of Applicability is a document people use. The ISMS owner can sit an interview without a script.

Put 27001 on this RFQ when most of these are true:

• The customer, portal, insurer, or bid in front of you names 27001, an accredited ISMS certificate, or information-security certification, on a date you can point at.
• You can describe the information in scope: what you hold, where it lives, which legal entity operates it.
• Someone owns risk treatment, access, incidents, and suppliers, and can be interviewed.
• The Statement of Applicability matches the system you operate. Applicable controls have evidence. Exclusions have a reason you will defend at Stage 1.
• The AI ask is a forecast. It is not a certificate field that kills a contract this cycle.
• You are not offering an ISMS certificate as a stand-in for an AI-management promise already in the contract. If the exhibit names ISO/IEC 42001 or an AI management system, 27001 will not clear it.

A later 42001 add is a normal plan. One line on the pack is enough. Leave 42001 off this RFQ while the inventory is a list of tools nobody owns. The path guide treats security, then AI, as the default, because AI systems are information systems with extra impact modes. A forced 42001 gate is the exception you write down on purpose. If the ISMS does not exist yet, build it before you send. Readiness still has the first-certificate shape. A model card or an AI policy, with no certificate named, is still a security question until someone requires 42001. Quality versus security, and the plant stack, are the 9001 vs 27001 comparison and the IMS buying guide.

3. When 42001 is the forced gate this cycle

Start with 42001 when a customer, portal, or bid will not let you through without an AI management certificate this cycle, and you can show an AIMS with a named owner.

That is still the less common mid-market case. It shows up when buyers score AI governance on AI-enabled work, on models embedded in delivery, or on shop-floor AI they have decided to audit. A competitor's homepage does not create the gate. A named requirement with a date does. The system has to exist before the pack goes out: inventory, impact and risk records, roles, and a lifecycle people run.

Put 42001 on this RFQ when most of these are true:

• A named customer, questionnaire, or bid requires ISO/IEC 42001, or an accredited AI management system certificate, on a date you can point at.
• You can list the AI systems in scope: systems you develop, systems you provide, and systems you use, including third-party and general-purpose models when they do the certified work.
• Someone other than a hopeful IT manager owns AI policy, impact and AI risk assessment, approval, monitoring, and retirement, and can be interviewed.
• Documented information matches Tuesday. The inventory is updated. Material systems have impact records. Model suppliers are visible. There is a way to take a system out of use.
• You can name where those systems are approved and where they run. That address is often a development office, one production line, or a delivery team. It is often not the largest factory, and it is often not the whole firm.
• The gate is real. A salesperson calling 42001 the current certificate is not a gate.

If the bid requires 42001 and the AIMS does not exist, build the system, then send the pack. Pasting an AI section onto the security manual will not survive Stage 1. If the missing piece is who may approve a model, finish that ownership before you collect day counts. Sequence and readiness live on the path guide and first ISO certification.

Leave 27001 off this cycle only when it is not the gate and you cannot staff both. Many rooms that think they belong here are still in the previous section. The customer scores information security, and AI is a paragraph in the same questionnaire. Read the field before you promote 42001. A 27001 certificate you already hold can make shared evidence easier to show. It does not put the AI systems into scope, and it does not appoint an AIMS owner.

4. What buyers get wrong

Three patterns show up in mid-market rooms. Each one produces unlike quotes, or a Stage 1 whose job is to discover fiction.

Treating 42001 as an AI badge with no AIMS. The certificate is the output of an independent audit, not a logo rented to clear a bid. The certification body samples. It does not write the inventory, the impact assessment, or the approval rule. Who implements versus who certifies is consultant vs certification body. A copilot policy, a banned-tools email, and a slide of model logos are a project. Finish it, or hire implementation help that will not also be the certifier, then send the RFQ.

Shopping both at once with hollow AI controls. "Quote 27001 and 42001, we're integrated" is a sentence, not a programme. Integration is real when shared processes already run (document control, internal audit, management review, corrective action), the ISMS work exists (information boundaries, risk treatment, a Statement of Applicability someone uses), and the AIMS work exists (an inventory, impact and AI risk records, named AI roles, a lifecycle you can walk). A control list that marks every AI control applicable, and cannot show one impact assessment, is hollow. Pairing it with a real ISMS asks for days on two systems, one of which is a PDF. If you want both certificates eventually, name which one is this cycle. "Both" is a claim about systems you run.

Treating 42001 as a substitute for 27001 when the portal asks for security. An AIMS certificate does not fill an information-security field. Customers who score vendor risk still want scoped information, a used Statement of Applicability, and evidence that access, incidents, and suppliers operate. Dropping 27001 because 42001 sounds more current fails the portal that still names security. The reverse miss belongs in the same meeting: a 27001 certificate does not certify AI governance. Confirm the legal entity's live schedule in the quarter you would book, the same habit as verifying accreditation.

"Quote whichever is easier" means the bodies are not quoting the same object. Accredited AIMS scope is a smaller set than 27001 scope, and it is still moving. Recheck it. Competence for the two standards is the next section. The sequence stays on the path guide.

5. How the RFQ, the scope, the sites, and the people differ

A quote is a designed audit programme. It starts from your facts. 27001 facts and 42001 facts are not the same list with a different title.

Scope. For 27001, name the information, the activities that handle it, and what sits outside the boundary. For 42001, name the AI systems in scope and the activities around them: develop, provide, or use, including which third-party models count. "The whole company" and "all AI" sweep in a sister entity, or put a certificate claim on a pilot that should stay out. More than one location is multi-site certification scope. Write that map before anyone counts days.

Sites. 27001 follows the information and the people who control it: headquarters, a development office, remote staff, a cloud estate the factory tour never enters. 42001 follows the AI systems: where they are designed or configured, where someone approves them, and where they do the certified work. A vision cell on one line is not every plant. A model used by one delivery team is not every office. The approval meeting may sit at headquarters while the system runs somewhere else. This cycle names one standard's sites. The other map stays off the pack, with one line that it is a later add.

People. 27001 interviews a security owner who can show the Statement of Applicability, plus the people who grant access and run incidents and suppliers. 42001 interviews an AIMS owner who can show the inventory, the impact records, and the rule for who may approve, monitor, or retire a system. "We'll bring the data-science lead in at Stage 2" means the pack is early. "The security manager will cover AI" is true only when that person owns those decisions. "The quality manager will cover both" usually means neither document has an owner.

One page, the same pack to every body. The full checklist is how to build a registrar RFQ / scope pack. For this decision, these rows have to be explicit:

Fact	If 27001 is this cycle	If 42001 is this cycle
Standard and edition	The 27001 edition you will claim	The 42001 edition you will claim
What is in scope	Information, activities, and the boundary	AI systems you develop, provide, or use, and what stays out
Document the owner can show	A used Statement of Applicability	An AI system inventory plus impact and AI risk records people use
Sites	Where that information is handled, including remote work and cloud if that is true	Where those systems are approved and where they run, which may be one line, one office, or a delivery team
Owner	Named ISMS or security owner	Named AIMS owner who can show approval, monitoring, and retirement
The other standard	Later add, or not this cycle	Later add, or not this cycle
Who implemented	Internal, named consultant, or none	The same disclosure. The implementer is not the certifier

Headcount is a band per site, not the about-page total. Shifts, follow-the-sun delivery, and the hours a model is in production belong on the pack because they change who must be available. A thinner story for one logo ends the comparison. What comes back (programme structure, travel, exclusions, competence) is what CB quotes include.

6. One CB programme this cycle, or a sequential add

Sometimes one certification body should quote 27001 and 42001 together. Often that request is the "we're integrated" habit applied before the AIMS exists.

One programme this cycle is honest when both systems already run under one legal entity, shared processes are real, both owners can sit the audit, and each standard has its own site story. You may still receive two certificates. Say which processes are shared and which work is standard-specific. Let the certification body restate the method. Do not ask them to invent integration you do not operate. Handing an ISMS auditor a new checklist does not create AIMS competence. Ask how they staff people who can sample the way you use AI: in-house development, third-party models, shop-floor systems, or models inside client delivery.

A sequential add is the better buy when only one system is real. Certify the gate this cycle. Add the other standard when its owner, its sites, and its documented information exist. A later add is still an RFQ, and the new scheme still gets Stage 1. Tell the shortlist which standard comes later. If the body you award now cannot cover it, the honest options are wait, add a second certification body, or plan a transfer.

A second certification body is a legitimate design when competence differs. The body that holds your ISMS may not hold live accredited AIMS scope in the quarter you would book. A specialist AIMS body may be the wrong ISMS auditor for your stack. One body for 27001 and another for 42001 is a clean procurement when you write it on purpose. Each pack names one standard, says where the other certificate sits, and goes only to bodies you could award for that standard. Two requests to "quote both and we'll see" will not converge. When that second body is for ISO/IEC 42001 and the buyer is in the US, the directory profiles that state 42001 on a published accreditation scope are compared in how to choose an ISO/IEC 42001 certification body in the US.

Keep ISO 9001 and the plant stack off this argument unless quality or EHS is also a named requirement this cycle. Use the 9001 vs 27001 comparison and the IMS buying guide for those buys. If the argument is which of 9001 or 42001 goes on this RFQ, and information security is not the choice, use ISO 9001 vs ISO 42001. Confirm the legal entity in how to choose a registrar and how to verify accreditation. The 42001 briefing is where the recheck habit for a moving AIMS schedule already lives.

7. Choose what goes on this RFQ, then send one pack

Make the call in one sitting. The output is a sentence at the top of the scope pack.

1. Write the actual requirement. Portal, contract, insurer, bid. Use their words. If one field says information security and another says an AI management certificate, note which revenue is blocked this cycle.
2. Match it to a system you can show. 27001 needs an ISMS and a used Statement of Applicability. 42001 needs an AIMS: inventory, impact and AI risk records, and a named owner for approval and retirement. If that system does not exist, do not send. Build it, or hire an implementer who will not certify you, and disclose them on the pack.
3. Name one primary standard. Mark the other "later add" or "not this cycle," unless both systems and both owners are real enough to defend at Stage 1.
4. Name the owner and the sites for that standard. Security owner and the locations where the information is handled, or AIMS owner and the locations where the AI systems are approved and run.
5. Write one pack and send it to every body you might award for that standard. How to choose them is how to choose a registrar. Confirm the legal entity's accreditation for this edition in how to verify accreditation before you invite a body you cannot award. If you are using two bodies on purpose, each still receives one pack for one standard.

If the room is still split after step 3, you have two procurements. Run the one that unblocks revenue and park the other until its system exists.

When that sentence is true, send one registrar RFQ / scope pack. Submit the same page with the Get quotes button below, including to the logo you already like. The standard on the page has to be the standard you can staff.