A housing authority privacy officer asks how ISO AI management standards relate to existing ISO 27001 controls for tenant-data AI tools. What is the soundest guidance?

Treating AI management standards as complementary to the ISMS—covering AI-specific lifecycle and trustworthiness gaps without collapsing the two—is the soundest guidance for a housing authority already running ISO 27001-style controls over tenant-data AI tools. Classic ISMS strengths (asset management, access control, cryptography, incident response) remain necessary for tenant PII repositories and integrations. AI management standards add model lifecycle, data for training/evaluation, impact assessment, transparency, and AI-specific roles that a traditional Annex A mapping may not detail. Complementarity preserves the audited ISMS while closing AI gaps.

Claiming ISO 27001 already covers every AI-specific management need fails because model behavior, dataset provenance, and trustworthiness metrics are not fully expressed in general information-security controls alone. Asserting that AI management standards fully supersede ISO 27001 and retiring the ISMS fails conceptually: you would discard proven security management for confidentiality of tenant data while chasing AI-only paperwork. Applying AI management standards only to marketing copy while keeping security out of scope fails because the risk lives in operational AI processing of tenant data, not in brochures.

Exam caveat: “complementary” does not mean duplicate conflicting procedures; integrate AI clauses into management review, risk assessment, and supplier management so staff see one coherent system.

Operational check: map AI management requirements to existing ISMS processes, identify lifecycle/trustworthiness gaps for tenant-data tools, and document that neither framework is being ignored or wholesale replaced.