Last updated: 9 November 2026
ISO 9001 shows you run consistent, quality-managed services. ISO 27001 shows you protect information. ISO 42001 shows you manage AI responsibly. Pick the one your customers, tenders or regulators are asking for first, because all three share the same structure and can be combined later.
The three standards compared
| Standard | What it covers | Usually asked for by |
|---|---|---|
| ISO 9001 | Quality management: consistent processes, customer satisfaction, continual improvement | Public sector, construction, manufacturing and supply chains |
| ISO 27001 | Information security management system (ISMS) | Larger customers, regulated sectors and tenders |
| ISO 42001 | AI management system: responsible development, supply and use of AI | Customers and partners asking how you govern AI |
What about ISO 27000?
ISO 27000 is the vocabulary and overview for the whole 27000 family, so it is not something you certify against. ISO 27001 is the certifiable requirement, ISO 27002 gives control guidance, and ISO 27701 extends it to privacy. When someone asks for “ISO 27000”, they almost always mean ISO 27001.
Start with the ask
Check the tender, contract or customer questionnaire. If a standard is named, that is your first target.
Share the structure
All three follow the same management system structure, so policies, audits and reviews can be shared.
Phase it
Many small businesses do ISO 27001 first, then add ISO 9001 or ISO 42001 using the same foundations.
Use an independent auditor
A UKAS accredited certification body audits you and issues the certificate. Tools and consultants prepare you, they do not certify you.
How ABCOM helps
We work with independent ISO consultants and use Vanta as the compliance framework that tracks your controls, policies and evidence. Read how in How does ABCOM help with ISO certification?
Quick answers
Do we need all three?
No. Choose the standard a customer, tender or regulator is asking for and build from there.
Is ISO 27000 a certificate?
No. ISO 27000 is the overview and vocabulary. The certifiable standard is ISO 27001.
Can we combine them?
Yes. They share a common structure, so one integrated management system can support more than one certificate.
Not sure which ISO standard to start with? Book a free 20-minute call.
Related answers and guides
- What is ISO 9001, and does a small business need it?
- What is ISO 27001, and can a small business get certified with Vanta?
- What is ISO 42001, the AI management certification?
- How does ABCOM help with ISO certification?
- Why do businesses fail Cyber Essentials?
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about Microsoft Defender and Purview. Free, friendly and no obligation.