Connecting security, privacy, AI governance to reduce information risk

Ryan Boyes, Senior Security Administrator at Galix.

---

Information security, privacy and artificial intelligence (AI) governance are often treated as separate disciplines, but in practice, they are closely linked. AI systems rely on information, which often includes personal or confidential data. ISO 27001 provides the security foundation, ISO 27701 extends it into privacy management, and ISO 42001 introduces governance around AI usage and impact. Implemented together, they create a coherent approach to managing information risk, rather than three separate compliance exercises running in parallel.

Organisations are already using AI tools for reporting, document generation, customer engagement and data analysis. In many cases, these tools interact with business systems and process organisational information as part of everyday operations.

When an employee uploads client data into an external AI platform, the organisation is simultaneously facing an AI governance question, a privacy question and a security question. These are not separate incidents; they are the same incident viewed through three different lenses.

Consider a sales team using an AI tool to analyse customer data and generate proposals. The data is pulled from an internal CRM, processed through an external AI platform, and output as a client-facing document. This is the point where all three frameworks intersect: security controls govern access to the CRM, privacy requirements govern how personal information is handled in transit and at rest, and AI governance controls how the external platform is approved and monitored.

Without an integrated approach, each of these areas can be managed in isolation, and that is where the gaps appear.

The three standards share a common management structure and are designed to build on one another.

ISO 27001 establishes the security foundation: access control, asset management, risk assessment and governance. ISO 27701 extends this into privacy, covering how personal information is collected, processed, retained and destroyed. ISO 42001 then adds a layer of governance around AI systems, impact assessments and acceptable AI usage.

This means organisations do not need to create entirely separate systems for each standard. Many of the same processes, policies and governance structures can be extended across all three frameworks.

For example, organisations already maintaining software asset registers under ISO 27001 can simply expand these to include approved AI tools under ISO 42001. Data retention and destruction processes for ISO 27701 can also apply to information processed through AI systems. The result is less duplication and a governance structure that grows incrementally rather than starting from scratch three times.

A common and costly assumption is that controls in one area automatically cover another. An organisation may have strong security controls in place under ISO 27001, but without formally classifying the information flowing through its systems, it cannot determine whether personal data is being processed through AI tools or whether additional privacy controls are required.

Equally, an organisation that deploys an AI system without checking where it is hosted or what data it retains may only discover the gap during a client security assessment, or after a breach. 

This is why the standards need to work together rather than being treated as separate compliance exercises. Security controls support privacy management, while privacy management influences how information can be processed through AI systems.

For organisations starting this journey, ISO 27001 is typically the logical foundation because it establishes the governance and security structures that the other standards build on. Once it is in place, ISO 27701 and ISO 42001 can be integrated into existing processes rather than implemented as separate initiatives, each adding a layer without requiring a rebuild.

The same systems, data and processes now sit across security, privacy and AI governance simultaneously. Treating these as separate compliance work streams creates overhead, introduces gaps and misses the point: the risks are connected, so the governance should be too.

Implementing them effectively requires an honest view of how these areas intersect within your specific environment. An experienced cyber security and compliance partner can help identify where the gaps are, reduce duplication across frameworks and build controls that serve both operational and compliance needs.