ISO 27001 and AI: how does AI use fit into your ISMS?
ISO 27001 does not mention AI, but it requires policy, classification, supplier management, awareness, and data leakage prevention. Here is how to bring AI use under those controls.
Quick answer
ISO 27001 is the international standard for an information security management system (ISMS). The standard does not mention AI, but several Annex A controls touch AI use directly: policy and acceptable use, information classification, supplier management for cloud services, awareness and training, and data leakage prevention. AI tools are suppliers that process your data, so they belong in your risk assessment and your controls. The data leakage prevention control (A.8.12) applies most directly here.
01
ISO 27001 requires an ISMS; AI use should fall under your existing controls
02
AI tools are suppliers: include them in supplier management and risk assessment
03
Classification and acceptable use decide which data may enter an AI tool
04
The data leakage prevention control (A.8.12) touches AI use directly
05
Awareness at the point of use beats a once-a-year training
Many organisations with an ISO 27001 certificate have their policy, classification, and supplier management neatly in place, but written for a world without AI assistants. The standard itself does not mention AI. Yet you do not need to build a new framework: AI use fits the controls you already have. You just have to apply them to a new kind of risk.
ISO 27001 is the international standard for an information security management system (ISMS). It is built on risk-based work: you assess risks and choose appropriate measures, the so-called controls in Annex A. In the 2022 version, those are grouped into four themes: organisational, people, physical, and technological. AI use mainly touches the organisational and people controls, plus one important technological one.
Policy and acceptable use. Your information security policy and your acceptable use rules must make clear which AI tools may be used and with which data. Without that, AI use sits outside your ISMS.
Information classification. Which data is confidential, internal, or public? That classification decides what may and may not enter an AI tool. A prompt with confidential customer data is a classification problem before it is an AI problem.
Supplier management. An AI tool that processes your data is a supplier or cloud service. It belongs in your supplier assessment, with attention to what the provider does with the data. Unapproved AI tools are unmanaged suppliers, that is, shadow AI.
Awareness and training. People must know what they can and cannot share. That is a people control, and ties directly to what you can and cannot share with AI.
Data leakage prevention. The 2022 version of the standard has a dedicated control for data leakage prevention (A.8.12). This is the control AI use touches most directly, because the core risk is exactly that: sensitive data leaving the organisation through a prompt or upload.
Supplier management assumes you can name your suppliers. For AI, most organisations can name the two or three tools they formally rolled out, not the full list employees have actually opened on a given day. That gap is exactly what the risk assessment is supposed to close, and you cannot assess a tool whose existence you do not know about.
Search tool, vendor or category…
865 tools
ChatGPT🇺🇸
HighAllowed
Claude🇺🇸
MediumAllowed
DeepSeek🇨🇳new
CriticalNot allowed
Perplexity🇺🇸new
MediumNo decision yet
Mistral🇫🇷
LowNo decision yet
Midjourney🇺🇸
MediumNo decision yet
Every tool, scored for risk
865 AI tools, each scored Low to Critical, with nothing pre-approved or pre-blocked until someone decides.
Each tool arrives already scored against BeeSensible's catalog, with a status of allowed, limited use, not allowed, or the default no decision yet, so the unmanaged supplier turns into an assessed one.
Classic measures against data leaks look at email, USB sticks, and uploads to known services. A prompt is something new: free text, in the browser, to a service that can store the input or use it for model improvement. The data leakage prevention control calls for appropriate measures, and those measures must therefore also reach the text field of an AI tool. Otherwise you cover email but not the fastest-growing route.
ISO 27001 calls for awareness, and most organisations fill that in with a yearly training. It helps, but under time pressure behaviour rarely changes. A signal at the point of use works better, so the control exists somewhere other than on paper. See why security training alone does not close the AI gap.
BeeSensible makes several controls concrete in one place: the text field. Sensitive data gets a highlight while someone types in browser-based AI tools, so it can be masked or removed before the prompt is sent.
Here is that highlight in the field itself, the moment before a name or file number would otherwise leave in the clear.
BeeSensible highlights sensitive details before send.
Hover or tap a highlighted value to mask or delete it - before the draft reaches anyone.
That supports:
Data leakage prevention (A.8.12): sensitive data gets a highlight before it leaves the organisation through a prompt.
Classification in practice: detection profiles align with what you have marked as sensitive.
Awareness at the point of use: the employee sees the risk exactly when it arises.
Demonstrability: an administrator sees, at an aggregate level, where data risks sit, without reading the content of personal chats.
A.8.12 does not stop at typed text either. The same file that gets pasted into a prompt often exists first as a PDF, a case file or a contract, with the names, IBANs, or health data already sitting in it. On Windows and macOS, the desktop app opens that document and marks the same categories before anyone exports or shares a clean copy.
PreviewAnonymise (4)
The desktop app marks sensitive fields in a document for you to redact before you share it or paste it into AI.
It runs in the EU, the same as the browser extension, and it is a step someone takes deliberately before sharing a file, not a scanner sitting on every attachment.
An example: an organisation classifies customer files as confidential. Detection highlights names, file numbers, and IBANs in prompts, so they can be removed before the prompt is sent. The data leakage prevention control then no longer lives only in a document; it does something.
The infrastructure BeeSensible runs on is ISO 27001 certified; BeeSensible itself is not. BeeSensible does not replace your ISMS, but it makes the relevant controls workable for AI use.
Take your Annex A list and ask the same question of policy, classification, supplier management, awareness, and A.8.12: does this measure also reach the text field of an AI tool? Wherever the answer is no, that is your next action.
ISO 27001 does not name AI separately, but the standard is risk-based. AI tools process information and are suppliers, so they fall under existing controls for policy, classification, supplier management, awareness, and data leakage prevention.
Which ISO 27001 control touches AI use most?
The data leakage prevention control (A.8.12 in the 2022 version) applies most directly, because the core AI risk is that sensitive data leaves the organisation through a prompt or upload.
Are AI tools suppliers under ISO 27001?
Yes. An AI tool that processes your data is a supplier or cloud service, and belongs in your supplier management and risk assessment. Unapproved AI tools are unmanaged suppliers, that is, shadow AI.
Should AI use be in my information security policy?
Yes. An acceptable use policy should make clear which AI tools may be used and with which data. That is part of both the policy and the awareness controls.
Is awareness training enough for AI risks?
Training helps, but it rarely changes behaviour under time pressure. ISO 27001 calls for awareness; in practice, a signal at the point of use works better than a yearly session.
Outlook
