ISO 42001 and the HITRUST AI Security Certification answer two different questions. ISO 42001 proves your organisation governs AI responsibly: policy, risk, impact, accountability and continual improvement. HITRUST AI Security proves a specific deployed AI system is secured against AI-specific threats such as prompt injection, data poisoning and model theft. Only 12 of HITRUST's 44 AI security requirements map to ISO 42001, so one does not substitute for the other.

If you sell AI into healthcare, insurance or other regulated sectors, you may be asked for either, or both. This guide explains what each certification actually tests, where they overlap, what each costs, and how to decide which to pursue first.

ISO/IEC 42001
International AI management system standard, published December 2023
HITRUST AI Security
Prescriptive AI security certification, generally available since 19 November 2024
What ISO 42001 certifies
The organisation's AI governance system
What HITRUST AI certifies
The security of a specific deployed AI system
HITRUST AI requirements
Up to 44, tailored by AI type (27 for rule-based AI)
Overlap
12 of 44 HITRUST AI requirements map to ISO 42001
Validity
ISO 42001: 3 years. HITRUST AI: 1 or 2 years, matching the base assessment

Governance vs security assurance: the core difference

ISO 42001: "Is AI governed here?"

A management system standard. It certifies that you have an AI policy, defined roles, AI risk and impact assessments, controls chosen from Annex A, internal audit, management review and continual improvement. It applies to any organisation that develops, provides or uses AI, in any sector, anywhere.

HITRUST AI Security: "Is this AI system secure?"

A prescriptive control certification. It tests whether a deployed AI system is protected against 13 named AI threats, from prompt injection to excessive agency, with specific requirements on red teaming, change control and data inventories. It is scored and certified centrally by HITRUST.

A useful analogy: ISO 42001 checks that the organisation has a working system for managing AI. HITRUST AI Security checks the locks on one particular AI system. A buyer worried about who is accountable for AI decisions wants the first. A buyer worried about attackers hijacking your chatbot wants the second.

ISO 42001 vs HITRUST AI Security at a glance

DimensionISO/IEC 42001HITRUST AI Security
OwnerISO and IEC (international)HITRUST (US-based assurance organisation)
FocusAI governance and managementAI system security
StyleRisk-based: you choose and justify controlsPrescriptive: specific requirements, scored against a threshold
ScopeOrganisation-wide AI management systemOne or more deployed AI systems
Who can certifyDevelopers, providers and users of AIAI application and platform providers that deploy AI. AI developers and customers are not eligible.
Stands alone?YesNo. Issued with a HITRUST e1, i1 or r2 assessment
Who auditsAccredited certification bodyHITRUST-authorised external assessor, then HITRUST central review
Fairness, bias and impact on peopleYes, through AI impact assessmentNot its focus
Prompt injection, poisoning, model theftOnly if your risk assessment selects such controlsExplicitly required
Continual improvement and management reviewRequired (Clauses 9–10)Not mapped
Validity3 years with annual surveillance1 year (with e1 or i1) or 2 years (with r2)
Strongest market pullGlobal, EU and regulated sectorsUS healthcare and its supply chain

What HITRUST AI Security actually tests

HITRUST announced general availability of the certification on 19 November 2024, describing it as the first certifiable, prescriptive AI security control specification. The requirements are built from security sources including the OWASP AI Exchange, the OWASP Machine Learning Top 10 and the OWASP Top 10 for LLM Applications.

The number of requirements depends on the kind of AI you deploy:

HITRUST AI security requirements by AI type
Rule-based AI 27
Predictive AI 36
Generative AI 41
Generative AI, fullest configuration 44

Those requirements address 13 named AI threats:

Input attacks

Prompt injection, evasion and denial of service.

Model attacks

Model extraction and theft, model inversion, data poisoning and model poisoning.

Supply chain

Compromised third-party models or code, and compromised third-party training datasets.

Output risks

Confabulation, sensitive information disclosure in output, and harmful code generation.

Autonomy

Excessive agency, where an AI system takes actions beyond what it should.

Not covered

Deployments that are banned or unacceptable under applicable AI regulation are excluded from scope.

Inheritance saves real effort

Of the 44 requirements, 13 are fully inheritable and 12 are partially inheritable from a HITRUST-assessed platform provider. That means over half can be at least partly covered by your cloud or AI platform's own HITRUST assessment.

Where they overlap, and where they don't

Schellman, an auditor accredited for both schemes, mapped HITRUST's AI requirements against ISO 42001. It found that 12 of the 44 HITRUST AI Security requirements map to ISO 42001, and noted that a mapped requirement may not cover the whole ISO clause. HITRUST itself positions its AI requirements as a complement to ISO 42001, not a replacement.

12 / 44HITRUST AI requirements that map to ISO 42001
13named AI security threats HITRUST AI addresses
57%of HITRUST AI requirements at least partly inheritable
AreaISO 42001HITRUST AI Security
Scope and context (Cl. 4)RequiredMapped
AI policy and roles (Cl. 5)RequiredMapped
Risk treatment and impact assessment (Cl. 6.1)RequiredMapped
Competence and awareness (Cl. 7)RequiredMapped
AI objectives (Cl. 6.2)RequiredNot mapped
Internal audit and management review (Cl. 9)RequiredNot mapped
Continual improvement (Cl. 10)RequiredNot mapped
AI red teaming at set points, at least annuallyNot prescribedRequired
Change control for agents and pluginsNot prescribedRequired
Data inventory with sensitivity levels, reviewed semiannuallyNot prescribed at that frequencyRequired

Put simply: ISO 42001 has the management loop HITRUST lacks, and HITRUST has the security specifics ISO 42001 leaves to you. They fit together rather than compete.

Deciding between them for a client or your own company?

I share practical AI assurance comparisons like this one most weeks. Connect with me on LinkedIn and tell me which buyer is asking for what.

What buyers are really asking for

When the buyer asks for HITRUST

HITRUST is deeply embedded in US healthcare procurement. Hospitals, payers and health systems often require HITRUST from vendors that handle protected health information. If your AI product touches patient data and your customers already ask for HITRUST e1, i1 or r2, adding the AI Security certification is the natural next step. It reuses the same assessor, the same portal and the same scoring model.

HITRUST also leans on outcomes data. Its 2026 Trust Report states that 99.62% of HITRUST-certified environments reported no security breach in 2025. That is HITRUST's own figure, so treat it as a vendor claim rather than an independent study, but it is the kind of number that resonates with healthcare risk committees.

When the buyer asks for ISO 42001

ISO 42001 travels further. It is recognised internationally, applies to every sector, and is the standard named in European and global AI governance conversations. AWS, Microsoft, Google, Anthropic and other major AI providers hold it. If your buyers are outside US healthcare, ask how AI is governed overall, or are preparing for the EU AI Act, ISO 42001 is the stronger signal.

Neither one proves a model is fair, accurate or safe

ISO 42001 certifies a management system, not a model. HITRUST AI Security certifies security controls, not outcomes. A buyer evaluating a clinical or credit-decision AI will still ask about validation, bias testing and performance. Have that evidence ready separately.

Cost and effort

HITRUST AI Security cannot be bought on its own, so its true cost includes the base HITRUST assessment you pair it with. Published 2026 estimates for the base tiers are below. ISO 42001 costs depend heavily on scope, AI maturity and the certification body you choose.

OptionRequirementsTypical timelineEstimated year-one costValidity
HITRUST e1 + AI SecurityAbout 44 base + up to 44 AIAbout 10 weeks for e1$35K–$65K for e1, plus the AI add-on1 year
HITRUST i1 + AI Security182 base + up to 44 AI6–9 months for i1$120K–$200K for i1, plus the AI add-on1 year
HITRUST r2 + AI SecurityRisk-based, often several hundred + up to 44 AI14–15 months for r2$400K–$750K+ for r2, plus the AI add-on2 years
ISO 42001Clauses 4–10 plus selected Annex A controlsCommonly 6–18 monthsVaries by scope and certification body3 years

HITRUST base-tier figures are a consultancy's published estimates for 2026 and include internal effort; get quotes for your own scope.

Which should you pursue first?

Start with HITRUST AI Security when

  • You sell into US healthcare and buyers already require HITRUST
  • You already hold or are pursuing HITRUST e1, i1 or r2
  • Your AI is generative or agentic and buyers fear prompt injection and data leakage
  • You run on a HITRUST-assessed cloud and can inherit controls

Start with ISO 42001 when

  • You sell outside US healthcare, or internationally
  • Buyers ask how AI is governed, not just secured
  • You are preparing for the EU AI Act
  • You develop models as well as deploy them

For many healthcare AI vendors, the answer is both, in sequence. Schellman's recommendation is a sensible default: use HITRUST as the security baseline for AI in use, and ISO 42001 for ongoing governance. The 12 mapped requirements give you a head start on whichever comes second.

Not sure where you stand yet?

HITRUST also offers a separate AI Risk Management Assessment with 51 controls, built on ISO/IEC 23894 and the NIST AI RMF. It produces an insights report rather than an AI Security certification, which makes it a lower-pressure way to baseline your governance.

A 5-step path to holding both

  1. Ask your top buyers what they will accept

    Find out whether their vendor risk team names HITRUST, ISO 42001, or simply wants AI questions answered. Their answer sets the order.

  2. Build one AI system inventory

    List every AI system, its type (rule-based, predictive or generative), data sensitivity, third-party models and owner. Both schemes need it, and it decides how many HITRUST requirements apply.

  3. Stand up the governance core

    An AI policy, named roles, and a risk and impact assessment method. These satisfy ISO 42001 Clauses 5–6 and the mapped HITRUST requirements at the same time.

  4. Add the security specifics

    AI red teaming, change control for models, agents and plugins, output filtering and supply-chain checks on third-party models. Claim inheritance from your platform provider wherever you can.

  5. Close the management loop

    Internal audit, management review and continual improvement turn a HITRUST-ready control set into a certifiable ISO 42001 management system.

A prompt to map your controls to both

Paste in your current AI controls to see which ones count towards each certification, and where the gaps are. Use it as a starting draft for your assessor, not a final answer.

ISO 42001 + HITRUST AI gap mapping prompt
You are an AI assurance lead familiar with ISO/IEC 42001:2023 and the
HITRUST AI Security Assessment and Certification.

Our AI system:
[type: rule-based / predictive / generative; agentic features; data
sensitivity; third-party models and platforms; where it is deployed]

Our current controls and documents:
[paste policies, procedures, risk assessments, testing practices]

Produce a table with these columns:
- Control or document we have
- ISO 42001 clause or Annex A control it supports (or "none")
- HITRUST AI threat area it addresses (or "none")
- Strength of evidence: strong / partial / weak

Then list separately:
1. ISO 42001 requirements we have no evidence for, especially
   Clauses 6.2, 9 and 10.
2. HITRUST AI security areas we have no evidence for, especially
   prompt injection, poisoning, model theft, excessive agency and
   AI red teaming.
3. Controls we could inherit from our cloud or AI platform provider.
4. The five gaps to close first, and why.

Use only what I provide. Mark anything you are unsure of as UNKNOWN.
ISO 42001 tells a buyer someone is steering. HITRUST AI tells them the doors are locked while you drive. Regulated buyers increasingly want to see both. — Kumail Mehdi

Frequently asked questions

Is HITRUST AI Security the same as ISO 42001?

No. ISO 42001 certifies an organisation's AI governance management system. HITRUST AI Security certifies the security controls around a specific deployed AI system. Only 12 of HITRUST's 44 AI security requirements map to ISO 42001.

Can I get HITRUST AI Security without a regular HITRUST certification?

Under the current specification, no. It is issued alongside a HITRUST e1, i1 or r2 assessment, and its validity matches that assessment: one year with e1 or i1, two years with r2.

Which is better for healthcare AI vendors?

If your customers already require HITRUST, start with HITRUST AI Security, because it plugs into the assessment they already trust. Add ISO 42001 when you need governance assurance, international recognition or EU AI Act readiness.

Does ISO 42001 cover prompt injection and data poisoning?

Only if your own risk assessment identifies them and you select controls for them. ISO 42001 is risk-based and doesn't prescribe specific technical defences. HITRUST AI Security names these threats and requires controls for them.

Can AI model developers get HITRUST AI Security certified?

The current specification is aimed at AI application and platform providers that deploy AI systems. AI developers, customers and users are not eligible on their own. ISO 42001 has no such restriction.

Does either certification satisfy the EU AI Act?

No. Neither is a harmonised standard under the AI Act, so neither creates a presumption of conformity. ISO 42001 provides strong groundwork for the Act's governance expectations, and HITRUST AI supports its security and robustness expectations.

Master AI governance in 6 months — 15 minutes a week

Join AI Governance – Decoded, my weekly newsletter that breaks down ISO 42001, HITRUST, the EU AI Act and the frameworks your buyers ask about into one short, practical read. And if you'd like to talk through your own certification path, connect with me on LinkedIn.

Subscribe to AI Governance – Decoded

Sources