top of page
Search

iso/iec 42001 & iso/iec 27090 are out - 2026

Writer: Muskan Gohil
Muskan Gohil
Oct 21
3 min read

Heres what it means for every organisation building, deploying and regulating AI.


ISO/IEC 42001 & 27090 by Muskan Gohil


The new ISO/IEC AI standards have officially landed and they’re about to reshape how every organisation builds, deploys, and secures AI systems.  

Untill now, companies have been improvising their own AI governance frameworks. That era is over. ISO has now delivered a global baseline for Responsible AI and Secure AI — and the implications are huge.


ISO/IEC 42001 — AI Governance Is Now Auditable

This is the world’s first AI Management System Standard (AIMS). It forces organisations to prove they have:

  • Documented AI risk controls

  • Clear accountability and oversight

  • Human‑in‑the‑loop safeguards

  • Lifecycle monitoring

  • Transparent AI purpose and limitations


If you build or deploy AI, 42001 applies to you.

This is the governance backbone the EU AI Act will expect organisations to align with.


ISO/IEC 27090 — AI Security Is Now a Discipline of Its Own

AI systems face threats traditional security frameworks never covered:

  • Data poisoning

  • Model theft

  • Prompt injection

  • Autonomous exploitation

  • Agentic behaviour

  • Misleading AI‑generated outputs


27090 is the first global standard that directly addresses these risks. It demands AI‑specific threat modelling, secure development, red‑teaming, and continuous monitoring.

This is the security blueprint organisations have been missing — and it aligns perfectly with the EU AI Act’s “Secure by Design” requirement.


ISO/IEC 17024 — Certification Bodies Must Now Meet AI Requirements

Even professional certifications are being reshaped. 17024 now includes AI‑specific clauses to ensure competence in AI governance, AI security, and AI risk management. This affects every accredited certification programme globally.


Why This Matters Right Now

The EU AI Act countdown has begun. From 2026 onwards, organisations will be required to operate AI systems that are:

  • Transparent

  • Secure

  • Independently Verified

  • Risk‑managed across the lifecycle


These new ISO standards are not optional guidance — they are the playbook regulators, auditors, and enterprise buyers will use to assess compliance.

If your organisation isn’t aligning with ISO/IEC 42001 and 27090 now, you will be behind when enforcement pressure hits.


The Real Risk

ISO standards don’t fine you. Regulators fine you when your AI system fails — and ISO standards define what “failure” looks like.

Non‑compliance → AI breach → Regulator investigation → EU AI Act / GDPR fines → Millions lost.

This is why ISO/IEC 42001 and 27090 are becoming the de facto global compliance baseline.


Standard

Direct Fine?

Real Financial Exposure

ISO/IEC 42001

❌ No

EU AI Act fines up to €35M / 7% turnover

ISO/IEC 27090

❌ No

UK GDPR fines up to £17.5M / 4% turnover

ISO/IEC 17024

❌ No

Accreditation loss, contract loss


What Organisations Should Start Doing Immediately


  • Map AI systems to ISO/IEC 42001 governance requirements

  • Implement AI‑specific security controls from ISO/IEC 27090

  • Build AI threat modelling into engineering workflows

  • Strengthen human‑in‑the‑loop oversight

  • Prepare for independent verification under the EU AI Act

  • Treat AI as a high‑risk asset, not a productivity tool


The companies that adapt early will be the ones that stay resilient. The ones that wait will be reacting to headlines instead of shaping them.

If you need help aligning with ISO/IEC 42001, 27090, or preparing for EU AI Act enforcement, feel free to contact us below.



References

ISO/IEC 42001 — AI Management System Standard (AIMS)

ISO/IEC 27090 — AI Cybersecurity Standard

ISO/IEC 17024 — Personnel Certification Standard (Updated for AI)

Comments

bottom of page