Already Running ISO 27001? Your AI Governance Programme Is Mostly Built
“Do we have an AI policy?” now reaches IT managers from clients, auditors and tender documents. If your organisation already runs an ISO/IEC 27001 information security management system (ISMS), you hold most of the machinery needed to answer it.
Two frameworks, two jobs
A Kovrr comparison published on Security Boulevard in October 2026 sets out the choice. ISO/IEC 42001 is certifiable through accredited bodies in a two-stage audit. NIST AI RMF is voluntary and free to apply, and it carries no certification.
| ISO/IEC 42001 | NIST AI RMF | |
|---|---|---|
| Output | Certificate from an accredited body | Self-assessment you can evidence |
| Scope | The organisation and its processes | Individual AI systems and their measured behaviour |
| Structure | Mandatory clauses 4 to 10, plus Annex A with 38 reference controls across nine objectives, applied selectively | Four functions: Govern, Map, Measure, Manage |
| Cost | Certification fees, audit cycles, documentation | Free to apply |
Use ISO 42001 for the structure external parties accept. Use NIST AI RMF for measurement depth, including adversarial testing and performance monitoring. The Kovrr article recommends capturing each requirement once against a normalised control set, so the two frameworks share evidence.
What you can reuse from your ISMS
Kovrr reports that roughly a fifth of the work remains specific to either framework. By implication, the large majority is shared, and an ISO 27001 ISMS already covers much of it. The same article estimates three to six months for an organisation already certified to ISO 27001 to extend, against six to twelve months for a fresh programme.
| ISMS asset you already have | Where it serves AI governance |
|---|---|
| Context, interested parties and scope (clause 4) | Define which AI systems and use cases sit in scope |
| Risk assessment and treatment method (clause 6.1) | Add AI-specific risks to the same register and scoring scale |
| Statement of Applicability | Record which 42001 Annex A controls apply, which do not, and why |
| Internal audit programme (clause 9.2) | Add the AI management system to the audit schedule |
| Management review (clause 9.3) | Add AI performance and incidents to the agenda |
| Supplier controls (A.5.19 to A.5.21) | Cover model providers, plugins and AI-enabled SaaS |
| Incident management | Add AI incidents to the same reporting path |
Kovrr maps shared control areas across the frameworks: impact assessment (ISO A.5, NIST Map), data governance (ISO A.7, NIST Measure), third-party relationships (ISO A.10, NIST Govern) and lifecycle documentation and logging (ISO A.6, NIST Manage).
What is new in ISO 42001
Three areas need fresh work:
- AI impact assessment (Annex A objective A.5). A documented view of context, affected people and intended use for each AI system.
- Lifecycle (A.6). Technical documentation and event logging across a system’s life.
- Data governance (A.7). Where training and input data came from, and how its quality is managed.
Reuse your existing document control, ownership and review habits for all three. Add the AI-specific content on top.
The POPIA layer
South Africa has no national AI policy. At a briefing reported by ITWeb on 17 September 2026 , Information Regulator chairperson Pansy Tlakula said “we don’t even have a national AI policy.” She also said “we are not convinced by the principle of privacy by default” and questioned whether personal information impact assessments are carried out at all.
Advocate Tshepo Boikanyo, the Regulator’s executive for POPIA, said “you cannot store the personal information beyond its intended purpose.” He added that, with AI models, the Regulator does not know what happens to personal information afterwards. The same report records that the Regulator says POPIA does not stand in the way of innovation.
Let POPIA drive the questions in your AI impact assessment:
- Purpose specification. What is each AI system’s stated purpose, and which personal information does it receive?
- Retention. How long do prompts, outputs, logs and fine-tuning data persist, and who can delete them?
- Automated decisions. Section 71 of POPIA addresses decisions based solely on automated processing of personal information. List every AI system that influences a decision about a person, and record the human review step.
- Operators. Record which vendors process personal information for each system, and link each to your vendor risk tiering .
A 90-day starter plan
==================================================================
ISO 27001 TO AI GOVERNANCE: 90 DAYS
==================================================================
DAYS 1-30: SCOPE AND INVENTORY
[ ] List every AI system, tool and agent in use, with an owner
[ ] Include AI features inside existing SaaS products
[ ] Mark which systems touch personal information
DAYS 31-60: ASSESS
[ ] Add AI risks to the existing risk register
[ ] Run a POPIA-led impact assessment on each in-scope system
[ ] Draft the AI policy under your existing policy framework
DAYS 61-90: GOVERN
[ ] Extend the Statement of Applicability with 42001 Annex A
[ ] Add AI to the internal audit schedule and management review
[ ] Choose NIST AI RMF measures for your highest-risk system
[ ] Decide whether certification is worth pursuing this year
==================================================================
The inventory in days 1 to 30 pays off twice. It feeds the policy, and it supports the governance of agent tooling covered earlier , where plugins, hooks and MCP configs count as third-party software.
FAQ
Do I need ISO 42001 certification?
Certification suits organisations whose clients or tenders ask for third-party verification. Kovrr states that a self-assessment does not answer a buyer who needs that verification. Without such a request, the ISMS extension and a NIST-based measurement practice deliver most of the governance value.
Does ISO 42001 certification prove EU AI Act conformity?
No. Kovrr states that certification is not conformity, and that ISO 42001 certification alone does not show that a high-risk AI system meets the EU AI Act.
Where do I start if I run no ISO 27001 ISMS?
Plan for the longer path. Kovrr estimates six to twelve months for a fresh programme.
Your ISMS already holds the risk method, the audit habit and the supplier discipline. Add the AI inventory, the impact assessment and the POPIA questions, and your AI governance programme is under way.
Sources: Security Boulevard / Kovrr, October 2026 ( https://securityboulevard.com/2026/10/nist-ai-rmf-vs-iso-42001-which-framework-to-use-kovrr); ITWeb, 17 September 2026 ( https://www.itweb.co.za/article/inforeg-unpacks-regulatory-complexities-posed-by-ai/KA3WwMdzPryvrydZ) . The section 71 reference is to the text of POPIA itself, not to the ITWeb report. Facts as reported; the standards texts were not reviewed directly.