ISO 42001 and ISO 27001 for law firms

ISO/IEC 42001:2023 sets out an AI management system: the policies, roles, risk checks and records an organisation uses to govern its use of AI. ISO/IEC 27001:2022 does the same for information security.

Neither is law. A firm needs a certificate only if a contract, a client or a regulator asks for one. See the framework pages for ISO/IEC 42001 and ISO/IEC 27001.

One system can cover both

Both standards use ISO’s harmonized structure: the same clause numbers and core text in clauses 4 to 10. So a firm can run one integrated system, with one set of policies, one risk register and one internal audit.

Each standard adds its own list of controls in Annex A. 27001 has 93 security controls in 4 themes. 42001 has 38 AI controls under 9 objectives, such as impact assessment, data provenance and intended use.

A firm can follow a standard without being certified to it. The difference is who checks the work, and what the firm may then say about it.

A certification body follows ISO/IEC 17021-1. For 42001 it must also meet ISO/IEC 42006:2025. Only certificates from an accredited body carry weight, so check the body on the accreditation body’s register (JAS-ANZ in Australia and New Zealand, UKAS in the UK, ANAB in the US).

1. Define the scope: which offices, systems and uses of AI the management system covers.
2. Put the management system in place and run it for some weeks.
3. Hold an internal audit and a management review.
4. Stage 1 audit: the certification body reviews the documents and readiness, often remotely.
5. Stage 2 audit: the certification body checks the system works in practice.
6. The certificate is issued. It is valid for 3 years.
7. Surveillance audits in years 1 and 2.
8. Recertification audit in year 3.

Source: Cloud Security Alliance. Under IAF MD 11 one integrated audit can cover 27001 and 42001 together, with less audit time than two separate audits.

For a small firm, estimates for a first year of 27001 alone run from about A$15k–30k to A$25k–80k. For 42001 with a narrow scope they are about A$23k–55k. One integrated audit of both takes less audit time than two separate audits, and a certificate takes about 4 to 18 months.

• Clayton Utz became the first Australian law firm certified to ISO 42001, on 9 June 2026. Clayton Utz media release.
• K&L Gates was among the first law firms certified globally, in March 2026. Mondaq.
• KPMG Australia was certified by BSI in October 2024. BSI Australia.

Firms that are not certified can still expect questions about AI governance in panel tenders and client security questionnaires. An aligned system, with a policy, a register of AI tools and impact assessments, gives the firm documents to answer them.

• Privacy Act. Since 11 December 2024, APP 11’s “reasonable steps” expressly include technical and organisational measures. 27001’s controls are a natural way to show them. MinterEllison.
• Automated decisions. From 10 December 2026 privacy policies must explain some uses of automated decision-making. 42001’s impact assessment and disclosure controls help. HWL Ebsworth.
• Government guidance. The Guidance for AI Adoption (October 2025) replaced the Voluntary AI Safety Standard. Both are voluntary and line up broadly with 42001.
• The profession. Court practice notes such as NSW SC Gen 23 and the regulators’ joint statement set duties for AI use. A firm’s 42001 controls on intended use and disclosure are where it records how it meets them.

1. Adopt an AI policy and name who is accountable for it. Start from the law firm AI policy guide.
2. Keep a register of the AI tools the firm uses, and what each may be used for.
3. Assess the risk and impact of each tool before staff use it on client work.
4. Record which Annex A controls apply, and why, in a Statement of Applicability.
5. Run an internal audit and a management review once a year.
6. Seek certification when a client, tender or insurer needs the certificate.

This is general information, not legal advice. ISO standards are sold, and iso.org could not be read automatically. Clause and annex details come from ISO catalogue pages, the NIST crosswalk and secondary sources: check them against purchased copies.