ISO 27001 is an international standard that sets out how an organization should run its information security. It asks for written policies, practical safeguards (called controls) and regular reviews to check that those safeguards still work. Think of a health inspection for a restaurant kitchen. The inspector checks that the kitchen follows a clear system, not that every meal is perfect. An organization that passes an audit by an accredited auditor can be certified.
Why it matters
When an AI vendor says it is “ISO 27001 certified,” that is a good sign, but it does not tell the whole story. Every certificate has a scope, and that scope may not cover the product you plan to use. For example, a vendor could be certified for its billing system while its new AI chatbot sits outside the audit. Before you sign up, ask the vendor which products and locations the certificate covers, and ask to see proof. You may also see vendors mention SOC 2 or ISO 42001. For more questions to put to a vendor, see our guide to AI vendor assessment questions.
Published Updated