SOC 2 or ISO 27001 for an AI company?

It depends on your buyers. SOC 2 is common with US enterprises; ISO 27001 is a certification recognized internationally. Many AI companies eventually pursue both. In Keel's open control library, 64% of the controls that map to SOC 2 also map to ISO 27001, so on a crosswalked platform that part of the second one is reuse and the rest is new work.

How does ISO 27001 relate to ISO 42001?

ISO 27001 manages information security; ISO/IEC 42001 manages AI. They use the same management-system structure, so an ISO 27001 program is a strong foundation for adding ISO 42001 afterward.

AI companies

ISO 27001 for AI companies

ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). For AI companies, it is the globally recognized way to show that security is managed systematically, which matters most with international and enterprise buyers.

Start free ISO 27001 overview

Context

Why it matters for AI companies

Where SOC 2 is a US-centric attestation, ISO 27001 is a certification recognized worldwide, so AI companies selling into Europe and beyond often need it. It also sets up ISO/IEC 42001 (AI management), because the two share the same management-system structure.

Priorities

What to focus on

01

A management system, then the controls

ISO 27001 is built around clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, and improvement) plus the Annex A controls. The 2022 revision organizes Annex A into 75+ controls across the organizational, people, physical, and technological themes.

02

What matters most for AI products

For AI companies the highest-value Annex A controls are access control and identity, cryptography, logging and monitoring, secure development, and supplier (third-party) management, which covers the model and infrastructure providers your product depends on.

03

It is the on-ramp to ISO 42001

ISO/IEC 42001 (the AI management system standard) uses the same harmonized management-system structure as ISO 27001. If you build your ISMS well, its management-system clauses carry over. The controls carry over less: in Keel's open control library, 42% of the controls that map to ISO 42001 also map to ISO 27001, and the AI-specific rest is new work. Keel keeps both on one crosswalked control library.

Do it once, not twice

Keel is built on one crosswalked control library, so a control you implement for ISO 27001 counts toward every other framework it satisfies. Add a second framework later and it mostly reuses this work. See the crosswalk explorer for the exact overlap.

Start free Check your readiness

Common questions

SOC 2 or ISO 27001 for an AI company?: It depends on your buyers. SOC 2 is common with US enterprises; ISO 27001 is a certification recognized internationally. Many AI companies eventually pursue both. In Keel's open control library, 64% of the controls that map to SOC 2 also map to ISO 27001, so on a crosswalked platform that part of the second one is reuse and the rest is new work.
How does ISO 27001 relate to ISO 42001?: ISO 27001 manages information security; ISO/IEC 42001 manages AI. They use the same management-system structure, so an ISO 27001 program is a strong foundation for adding ISO 42001 afterward.

More guides: ISO 27001 on Keel · ISO 27001 for SaaS companies · ISO 27001 for manufacturers · ISO 27001 for fintech companies · ISO 27001 for healthcare and healthtech · SOC 2 for AI companies · ISO 42001 for AI companies

Framework names are referenced factually for guidance. Keel is not affiliated with or endorsed by the bodies that publish them. See our legal and trademarks page.