ISO/IEC 27001
Voluntary. ISO standards are not legislation, and nothing in the standard requires a law firm to be certified unless a contract or regulator mandates it.
The international standard for an information security management system. Certification is voluntary and is issued by a certification body, not by ISO.
MaintainedLast reviewed
Key facts
- Issued by
- ISO and the International Electrotechnical Commission
- Sources listed
- 2
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
ISO/IEC 27001:2022 is titled Information security, cybersecurity and privacy protection — Information security management systems — Requirements. The IEC’s public entry says the document specifies requirements for establishing, implementing, maintaining and continually improving an information security management system, and requirements for assessing and treating information security risks tailored to the organisation.
The same entry says the requirements are generic and intended for all organisations, whatever their type, size or nature. Excluding any requirement in clauses 4 to 10 is not acceptable when an organisation claims conformity. ISO’s public page says the official name is ISO/IEC 27001, and that a claim should use the full reference, for example “certified to ISO/IEC 27001:2022”, not “certified to ISO 27001” alone.
Who it applies to
The standard can be used by any organisation. Nothing in it requires a law firm to be certified. A vendor’s certificate is the vendor’s, for the scope printed on the certificate. ISO says a certificate from an accredited certification body adds confidence because an accreditation body has checked the certification body’s competence. ISO does not itself certify organisations.
What it asks of a law firm using AI
- This page does not reproduce the standard. ISO and IEC sell it. The public abstract is the source for what is said here.
- A conformity claim covers clauses 4 to 10. Dropping one of those clauses is not conformity, on the IEC’s statement of the standard.
- Ask for the certificate, the year of the edition, the legal entity named, the sites and services in the scope, the certification body, and the expiry. A marketing line that says “ISO 27001” without those facts is a claim, not a certificate.
- The certificate speaks to the management system in its scope. It does not say that the plan, the tenant, or the feature the firm is buying was inside that scope.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Not set here. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | Seeing the certificate, the scope and the date is due diligence. Not seeing them is a gap. The certificate does not answer whether customer content is used for training, or where a particular tenant’s data sits. |
| Confidentiality Whether client and other confidential information can go into the tool. | An information security management system is about protecting information the organisation handles. It is not a solicitor’s confidentiality undertaking, and it is not a promise that prompts are excluded from training. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Not set here. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | This is the ISO 27001 fact the framework records. “Present” means the name appears in a source the catalogue or the firm has recorded. It is not a finding that the certificate covers the firm’s plan. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | The public abstract does not set a country of storage. Residency is a separate fact. Do not infer Australia, or anywhere else, from the letters ISO 27001. |
Sources
Checked 2026-10-10. Issued by ISO and the International Electrotechnical Commission.