The EU-native platform for security and AI teams
ISO 42001 and ISO 27001
Together in one EU-native platform
With Basenorm you run your AI management system and your ISMS on one control library, without doing the work twice. See what you can reuse, what to add for AI and who owns what.
Hosted in the Netherlands. Your data stays in the EU.People, agents and systems work together on compliance. Enable JavaScript for the 3D animation.
Illustration · not a calculated compliance score
01 / Approach
From ISO 27001 to ISO 42001
Build on what is already
in place
Already have ISO 27001? Then your policies, responsibilities and audit cycle are in place. ISO 42001 has the same structure (clauses 4 to 10), so you build on that and add what you need for AI.
Choose your starting pointDocument control and audits
Managed once
Check per standard whether your existing control and evidence are adequate.
From task to evidence
Evidence you can show for every control
Here’s how you help your team
Record in a task what the control requires. AI helps carry out the task and assess the evidence. A second colleague confirms the final result.
Example / access rights
Make expectations clear
Record what the evidence needs to demonstrate. Your colleague and the AI pre-check use the same requirements.
- 01Systems and accounts
Which systems and accounts were reviewed?
- 02Review and findings
How was the review performed and what exceptions were found?
- 03Follow-up
What was done about the exceptions?
02 / Unified Control Library
One control
for multiple
standards
Supplier management counts for ISO 42001, ISO 27001, NIS2 and the GDPR. In the Unified Control Library you record such a control once, with one owner and one set of evidence, and Basenorm shows which standards it counts for. Start with ISO 42001 and ISO 27001 and add other standards later.
About the Unified Control LibrarySee where each control counts. And where it does not
| Control | ISO 42001 | ISO 27001 | NIS2 | GDPR |
|---|---|---|---|---|
| Risk assessment | ||||
| Supplier management | ||||
| Documented information | ||||
| Internal audit & management review | ||||
| Access control | ||||
| AI impact assessment |
Check per organisation whether the control and evidence are adequate. According to Basenorm’s published mapping, ISO 27001 and NIS2 share 70 to 80% of their controls, so the next standard starts mostly complete.
03 / AskNorman
Norman,
what next?
Ask about your controls, risks and evidence, in Basenorm or from your own AI assistant such as ChatGPT or Claude via MCP. Norman searches and explains, you decide.
What do we still need to arrange for ISO 42001?
You can build on your existing ISO 27001 processes. In this example, these AI items still need attention:
Via MCP you work from a supported AI assistant, such as ChatGPT or Claude.
You use the relationships between controls, risks, evidence and owners.
You assess the outcome and decide which changes to make.
This example shows fixed answers.
04 / The AI Act
REGULATION (EU) 2024/1689ISO 42001 and
the AI Act
ISO 42001 is a standard, the AI Act is a law. An ISO 42001 certificate does not make you AI Act compliant by itself, but the management system helps you organise and evidence your obligations.
EN 18286 published. Harmonised standard for the quality management system, cited in the Official Journal.
High-risk AI, Annex III. Obligations start to apply for most high-risk systems.
High-risk AI, Annex I. Obligations for AI in products covered by sectoral legislation.
A management system, not a law. ISO 42001 covers policy, roles, AI risk and impact assessment, and controls that an accredited body can certify.
A certificate is not legal proof. ISO 42001 is not a harmonised standard under the AI Act. A certificate therefore does not give a legal presumption of conformity.
Work that carries over. EN 18286:2026, the harmonised standard for the quality management system under the AI Act, maps to the Annex A controls of ISO 42001 and gives a presumption of conformity with the Article 17 requirements it covers. What you set up now counts towards it.
Dates according to Regulation (EU) 2024/1689 as amended by the Digital Omnibus. EN 18286:2026 is cited in the Official Journal by Commission Implementing Decision (EU) 2026/2274.
05 / Security
Your auditor will ask how
we protect your data
Hosted in the EU
Based and hosted in the Netherlands, on EU infrastructure. Every customer gets a data processing agreement.
Encrypted and separated
Encrypted with TLS 1.3 in transit and AES-256 at rest. Every organisation has its own database.
Access under control
SSO and MFA, with roles for owner, admin, user and auditor. Least privilege by default.
Everything traceable
Every action is recorded in an immutable audit trail, exportable for external audits.
Your starting point
Where do you stand?
06 / Questions
Good
to know
What is Basenorm?
Basenorm is an EU-native platform for ISO 42001 and ISO 27001. You run your AI management system and your ISMS on one control library: shared controls and evidence are maintained once, and AI-specific requirements are added where they are needed. Basenorm is based and hosted in the Netherlands.
Do we need ISO 27001 first?
No. You can also build your first information security management system with Basenorm. The setup gives you a base that you can later extend with AI governance.
How much can we reuse for ISO 42001?
That depends on your scope, AI use cases and existing setup. Think of document control, responsibilities, internal audits and improvement actions. For each part you assess whether the content also works for AI. A fixed overlap percentage would oversimplify that assessment.
Which topics do we add for AI?
Among other things, you record your AI systems and their intended use. You assess AI risks and potential impact, set up data management and human oversight, and organise testing and monitoring. What exactly you need depends on your role and scope.
How does ISO 42001 relate to the EU AI Act?
ISO 42001 is not a harmonised standard under the AI Act, so certification alone does not give a presumption of conformity. It does give you the management system to organise and evidence your obligations, and the harmonised standard EN 18286:2026, which does give a presumption of conformity for the Article 17 requirements it covers, maps to the controls of ISO 42001.
What does MCP mean for our team?
MCP stands for Model Context Protocol. It lets a supported AI assistant retrieve information from Basenorm through the available tools. Which information and actions are accessible depends on your permissions and how the connection is set up.
Where is our data stored?
Basenorm is based and hosted in the Netherlands. All customer data stays on EU infrastructure and every customer receives a data processing agreement.
Does Basenorm certify our organisation?
Basenorm supports setting up, managing and demonstrating your management system. An independent certification body performs the certification audit and decides on the certificate.
Book a demo
See ISO 42001 in your own context
Together we look at where you stand today and what your next step is.
- Which existing processes you can reuse.
- What you need to add for your AI systems.
- How you manage controls and evidence together.
Hosted in the Netherlands. Your data stays in the EU.