Know the skeleton before you judge the standard

Thesis

ISO 42001’s clause structure is inherited, not bespoke. What looks like an omission is often the deliberate price of the Harmonized Structure, and knowing that changes how you read the standard and how you build to it.

Reader

An organisation that already holds ISO 27001 or 9001, which is common among suppliers to government, and assumes 42001 means a second system.

Opening failure

A team builds a separate AI management system, with its own risk register and its own management review, beside an ISMS that already does most of that job.

Beats

1. One skeleton: context, leadership, planning, support, operation, evaluation, improvement. Annex SL is now the Harmonized Structure (ISO/IEC Directives Part 1, Annex L, updated 2021). ISO 31000 sits underneath.
2. What it buys you: 42001 bolts onto an existing 27001 system without rebuilding governance.
3. What it costs: generic clauses fold domain risk into general buckets. 27001 compensates with its Annex A; 42001 compensates with Annex A and B. Topics with no backstop annex only surface if 4.2 or 6.1.4 catch them.
4. Before calling something a gap, check whether the structure was ever meant to carry it.

Market angle

For a small supplier with 27001 already, this is the cheapest route to AI governance anyone will offer them.

What you can do on Monday

If you hold another ISO certification, list which of your existing records (risk register, management review, internal audit) can carry AI as well.