Standards
The desk: quality, EHS, security, AI
Mid-market manufacturers and professional-services firms do not need five project plans. They need a sequence. This desk is the compare page for that sequence — not a catalogue of every ISO number that exists.
The path this site actually uses
Quality → security → AI governance. That maps to ISO 9001, ISO/IEC 27001, and ISO/IEC 42001. The order is a default, not a religion: 9001 teaches process owners, documented information, internal audit, and management review. 27001 adds information-asset scope and controls you can evidence. 42001 assumes you can already run a management system and talk about AI risk without theater.
Environmental and safety systems — ISO 14001 and ISO 45001 — sit beside quality as an operations stack. They matter for plants. They are not a substitute for information-risk discipline if you are about to certify AI. Construction-specific AI products are out of scope here.
When the question is sequence rather than a single standard, read the combined programme and the narrative 9001 → 27001 → 42001 guide.
Who starts where
Start with 9001 unless a customer has already moved the gate to 27001. Do not start 42001 to look modern if you cannot yet produce 27001-quality risk treatment. Do not buy three EHS certificates in year one if only 9001 is on the bid form.
Most manufacturers
Customer portals, primes, and export paperwork still start here. Learn the audit cycle on a system you already run.
Professional services and IT-led firms
Vendor-risk questionnaires often skip quality and open on information security. 9001 still helps if the work is repeatable.
Plants with coatings, waste, or customer EHS clauses
Start: 14001 / 45001 with 9001
The operations stack is one integrated programme, not three disconnected badges. Buy EHS because risk or a customer requires it.
Teams that already run 27001 and materially use AI
An AIMS is a governance layer, not a model badge. Confirm live accredited scope in the quarter you book Stage 1.
The six briefings
Each page is an editorial briefing for ops, quality, IT, and compliance leads — what the standard is for, what a certification body is actually certifying, and how to shortlist without folklore. They are not implementation manuals.
ISO 9001 · Quality
ISO 9001 Quality Management
The foundational quality-management system standard most mid-market manufacturers and many professional-services firms use to prove consistent process control.
Quality, operations, and customer-program leads
ISO/IEC 27001 · Security
ISO/IEC 27001 Information Security
The information-security management system standard that turns policies, risk treatment, and Annex A controls into something a customer or regulator can trust.
IT, security, and compliance leads
ISO 14001 · Environment
ISO 14001 Environmental Management
The environmental management system used by manufacturers and multi-site operators to control impacts, compliance obligations, and customer EHS expectations.
EHS, operations, and plant leadership
ISO 45001 · Safety
ISO 45001 Occupational Health and Safety
The OH&S management system standard that replaces a patchwork of older safety certificates with a single, auditable framework.
EHS, operations, and HR partners
ISO/IEC 42001 · AI governance
ISO/IEC 42001 AI Management
The first international AI management system standard — a governance layer for organizations that develop or use AI, not a model-quality badge.
IT, compliance, and executive owners of AI risk
Combined program · Path
Integrated path (9001 + security + AI)
How mid-market teams sequence ISO 9001, the EHS pair, ISO/IEC 27001, and ISO/IEC 42001 without buying five disconnected certificates.
Ops, quality, IT, and compliance leads planning a multi-year stack
Buying next steps
Accreditation and legal entity still beat brand. Read how to choose a registrar, how to shortlist and score 3–5, and how to verify accreditation, then compare bodies in the directory. If you already hold a certificate and the fit is wrong, use how to transfer an ISO certificate. If more than one site will sit on the certificate, scope the multi-site audit before anyone counts days. Write the outbound pack with how to build a registrar RFQ / scope pack, then request quotes.