ISO 27001 & AI Compliance

Overview

ISO/IEC 27001 is the internationally recognized standard for information security management systems (ISMS). Published by the International Organization for Standardization and the International Electrotechnical Commission, the standard provides a systematic approach to managing sensitive information through risk assessment, security controls, and continuous improvement. The 2022 revision (ISO/IEC 27001:2022) restructured the Annex A controls and added new ones, such as data masking and data leakage prevention, that bear directly on AI and data analytics systems. The transition period for certificates issued against the 2013 version ended on 31 October 2025.

ISO 27001 certification demonstrates to customers, partners, and regulators that an organization has implemented a risk-based approach to information security. For AI organizations, certification is increasingly a prerequisite for enterprise engagements, particularly in financial services, healthcare, government, and defense, where the sensitivity of training data and model outputs demands rigorous security governance. The standard is compatible with other frameworks including SOC 2, NIST CSF, and GDPR, and ISO/IEC 42001, published in 2023, adds a management system standard specifically for AI that is designed to sit alongside it.

ISO 27001 is a management system standard: organizations identify their own security risks and implement proportionate controls. For AI teams, this means assessing risks specific to machine learning workflows, including training data poisoning, model theft, adversarial attacks, data leakage through model outputs, and unauthorized access to sensitive datasets. The standard's emphasis on continuous improvement through Plan-Do-Check-Act (PDCA) cycles keeps security controls evolving as AI threats and technologies change.

AI-Specific Requirements

ISO 27001's Annex A provides a catalog of security controls organized into four themes: Organizational, People, Physical, and Technological. For AI systems, several technological controls are particularly relevant. Control A.8.1 (User endpoint devices) governs how workstations used for AI development are secured. Control A.8.3 (Information access restriction) requires that access to training data and model artifacts be restricted based on defined access control policies. Control A.8.10 (Information deletion) mandates secure deletion procedures for training data that is no longer required.

The 2022 revision introduced Control A.8.11 (Data masking), which directly applies to AI training data preparation. Organizations must implement data masking procedures, including pseudonymization and anonymization, in accordance with applicable legislation and business requirements. Control A.8.12 (Data leakage prevention) requires measures to prevent unauthorized disclosure of sensitive information, which for AI systems includes preventing training data extraction through model queries and protecting model weights from exfiltration.

Risk assessment under Clause 6.1.2 requires organizations to identify risks to the confidentiality, integrity, and availability of information assets. For AI organizations, this includes assessing risks to training datasets, model weights, hyperparameter configurations, evaluation results, and inference outputs. The risk treatment plan must address identified risks through controls, transfer, avoidance, or acceptance, and must be reviewed at planned intervals. Organizations must also maintain a Statement of Applicability documenting which Annex A controls are implemented and justifying any exclusions.

How Ertas Helps

In an ISMS, a custom model comes with two information assets that carry different risks: the training dataset and the trained model. Ertas Studio trains on Ertas's cloud GPUs, so the dataset is uploaded to Ertas and stored so runs can be repeated, which makes Ertas a supplier for that data under A.5.19 to A.5.22. Apply A.8.11 before upload by masking or pseudonymizing anything the task does not need, use Data Craft, Studio's dataset builder, to edit and approve each example, and delete the dataset under A.8.10 when it is no longer required.

The trained model is yours. Export it as GGUF or safetensors and run it in your own environment, where your existing controls for access restriction, logging, cryptography and leakage prevention already apply, and inference data never reaches Ertas. The exported version stays fixed until you retrain, so every model change goes through your own change management under A.8.32. The adaptive model endpoint and enterprise builds can run the model in your own cloud or on-premise.

The ISMS stays yours: the risk assessment and treatment plan, the Statement of Applicability, and the operation of every Annex A control in your environment. Ertas does not provide access control, logging or encryption for systems you run.

Compliance Checklist