ISO 27001 and AI: how does AI use fit into your ISMS?
ISO 27001 does not mention AI, but it does ask for policy, classification, supplier management, awareness and leak prevention. How to bring AI use within those controls.
Quick answer
ISO 27001 is the international standard for an information security management system (ISMS). It does not mention AI, but several Annex A controls bear directly on AI use: policy and acceptable use, information classification, supplier management for cloud services, awareness and training, and data leakage prevention. AI tools are suppliers that process your data, so they belong in your risk assessment and your controls. The data leakage prevention control (A.8.12) is the most directly relevant.
01
ISO 27001 requires an ISMS; AI use should fall under your existing controls
02
AI tools are suppliers: include them in supplier management and risk assessment
03
Classification and acceptable use decide which data may enter an AI tool
04
The data leakage prevention control (A.8.12) bears directly on AI use
05
Awareness at the point of use beats a once-a-year training session
Many organisations with ISO 27001 certification have their policy, classification and supplier management neatly in place, but written for a world without AI assistants. The standard itself does not mention AI. Even so, you do not need a new framework: AI use fits the controls you already have. You just have to apply them to a new kind of risk.
ISO 27001 is the international standard for an information security management system (ISMS). It takes a risk-based approach: you assess risks and choose appropriate measures, the controls in Annex A. In the 2022 version these are grouped into four themes: organisational, people, physical and technological. AI use mainly involves the organisational and people controls, plus one important technological control.
Policy and acceptable use. Your information security policy and your acceptable use rules must make clear which AI tools may be used and with which data. Without that, AI use sits outside your ISMS.
Information classification. Which data is confidential, internal or public? That classification decides what may and may not enter an AI tool. A prompt with confidential customer data is a classification problem before it is an AI problem.
Supplier management. An AI tool that processes your data is a supplier or cloud service. It belongs in your supplier assessment, with close attention to what the provider does with the data. Unapproved AI tools are unmanaged suppliers: in other words, shadow AI.
Awareness and training. People must know what they can and cannot share. That is a people control, and it applies directly to AI: our guide What you can and cannot share with AI sets out where the line lies.
Data leakage prevention. The 2022 version of the standard has a dedicated control for data leakage prevention (A.8.12). This is the control most directly relevant to AI use, because the core risk is exactly that: sensitive data leaving the organisation through a prompt or upload.
Supplier management assumes you can name your suppliers. For AI, most organisations can name the two or three tools they formally rolled out, not the full list employees have actually opened on a given day. That gap is exactly what the risk assessment is supposed to close, and you cannot assess a tool you do not know exists.
AI register
AllowedUnder reviewNot allowedAll tools
Search by tool, vendor, domain or former name…
1,012 tools
🇨🇳
DeepSeek
Critical · 90/100
Not allowed
🇺🇸
Otter.aiNew
High · 68/100
No decision yet
🇺🇸
Grok
High · 67/100
Not allowed
🇺🇸
ChatGPT
High · 62/100
Allowed
🇺🇸
Perplexity
Medium · 55/100
No decision yet
🇺🇸
HeyGen
Medium · 53/100
No decision yet
Every tool, scored for risk
Over 1,000 AI tools, each scored from Low to Critical. Nothing is approved or blocked until someone decides.
Each tool that turns up already has a risk score from BeeSensible's catalogue and a status: "Allowed", "Limited use", "Not allowed" or the default, "No decision yet". That turns the unmanaged supplier into an assessed one.
Traditional measures against data leaks focus on email, USB sticks and uploads to known services. A prompt is something new: free text, typed in the browser, sent to a service that may store the input or use it to improve its model. The data leakage prevention control calls for appropriate measures, so those measures must reach the text field of an AI tool as well. Otherwise you cover email but not the fastest-growing route out.
ISO 27001 calls for awareness, and most organisations meet that with an annual training session. It helps, but it rarely changes what people do under time pressure. A cue at the point of use works better and means the control exists somewhere other than on paper. See why security training alone does not close the AI gap.
BeeSensible puts several controls into practice in one place: the text field. Sensitive data is highlighted as someone types in browser-based AI tools, so it can be masked or removed before the prompt is sent.
Here is that highlight in the text field itself, just before a name or case number would otherwise leave in the clear.
Outlook
New message
Todr.smith@clinic.co.uk
SubjectClient file: Client
BeeSensible highlights sensitive details before you send.
Hover over or tap a highlighted value to mask or delete it before the draft reaches anyone.
That supports:
Data leakage prevention (A.8.12): sensitive data is highlighted before it leaves the organisation through a prompt.
Classification in practice: detection profiles match what you have classified as sensitive.
Awareness at the point of use: the employee sees the risk exactly when it arises.
Visibility for the audit: an administrator sees in aggregate where the data risks lie, without reading the content of anyone's chats.
Nor does A.8.12 stop at typed text. The same file that gets pasted into a prompt often starts out as a PDF, a case file or a contract, with the names, IBANs or health data already in it. BeeSensible opens that document in the extension, the dashboard or the desktop app (the latter for PDF only) and highlights the same categories before anyone exports or shares an anonymised copy.
PreviewAnonymise (4)
The desktop app highlights sensitive fields in a document so you can redact them before you share it or paste it into an AI tool.
It runs in the EU, like the browser extension, and it is a step someone takes deliberately before sharing a file, not a scanner trawling through every file. In ChatGPT and Claude the organisation can choose to hold back an attached file first, so the employee decides whether to review and mask it.
An example: an organisation classifies customer files as confidential. Detection highlights names, case numbers and IBANs in prompts, so they can be removed before the prompt is sent. The data leakage prevention control then no longer exists only in a document; it does something.
The infrastructure BeeSensible runs on is ISO 27001 certified; BeeSensible itself is not. BeeSensible does not replace your ISMS, but it makes the relevant controls workable for AI use.
Take your Annex A list and ask the same question of policy, classification, supplier management, awareness and A.8.12: does this measure also reach the text field of an AI tool? Wherever the answer is no, you have your next action.
ISO 27001 does not name AI separately, but the standard is risk-based. AI tools process information and are suppliers, so they fall under existing controls for policy, classification, supplier management, awareness and data leakage prevention.
Which ISO 27001 control is most relevant to AI use?
The data leakage prevention control (A.8.12 in the 2022 version) applies most directly, because the core AI risk is that sensitive data leaves the organisation through a prompt or upload.
Are AI tools suppliers under ISO 27001?
Yes. An AI tool that processes your data is a supplier or cloud service and belongs in your supplier management and risk assessment. Unapproved AI tools are unmanaged suppliers: in other words, shadow AI.
Should AI use be in my information security policy?
Yes. An acceptable use policy should make clear which AI tools may be used and with which data. That is part of both the policy and the awareness controls.
Is awareness training enough for AI risks?
Training helps, but it rarely changes what people do under time pressure. ISO 27001 calls for awareness; in practice, a cue at the point of use works better than a yearly session.
Outlook
