Your ₹3 Lakh ISO 27001 Audit Missed 11 AI Controls. Your Buyer Won't.

TL;DR: Your ISO 27001 certificate is valid, but it was issued before AI systems were in scope. ISO 27001:2022 added 11 new Annex A controls that map to AI runtime risks like data poisoning, model drift, and training data leakage. A basic audit that excluded ML systems from scope never tested any of them. Closing the gap is a 30-day scoping, SoA rewrite, and evidence exercise, not a full re-audit.

Key Takeaways: - ISO 27001:2022 added 11 new controls. They test for data masking, DLP, threat intelligence, and monitoring activities, the exact layers where AI systems fail. - If your ISMS scope excluded AI/ML systems, the original audit was honest. The certificate is now silent on what your buyer's security team asks about. - A targeted 30-day SoA update and evidence pack closes the gap at a fraction of the cost of a full re-certification cycle.

You passed the audit. You have the certificate. You paid ₹3 lakh and walked away with a credential that carried weight for years.

Then a Fortune 500 prospect's security team sent a questionnaire. It asked about threat intelligence feeds, data poisoning scenarios, and model drift monitoring. Your Statement of Applicability had nothing to say.

The compliance officer opens the email. A Fortune 500 prospect has sent a security questionnaire, and it asks dozens of detailed questions. Most of them are things the team has never been asked before.

Threat intelligence feeds about adversarial machine learning. Data masking policies scoped to training pipelines. Monitoring thresholds for model drift. Data leakage prevention on model outputs.

The team has a valid ISO 27001 certificate. They paid for it, passed the audit, and received the document.

The problem is that the Statement of Applicability has no entries for any of these. The SoA is the single document that proves which Annex A controls apply and which don't.

This is not a failure of the audit. The audit was honest. The ISMS scope was defined.

If AI and ML systems were excluded from that scope, the auditor had no obligation to test AI-specific controls. The certificate says "compliant" because the systems in scope were compliant. The buyer's questionnaire asks about systems that were never in scope.

The deal stalls. Not because the product failed. Not because the engineering work was bad.

The pipeline freezes because the compliance function cannot answer the questions that AI-era enterprise buyers actually ask.

The cost is not just the stalled deal. It's the sunk ₹3 lakh on a certification that does not produce the artifacts the buyer demands. It's the internal pressure on a compliance team that did nothing wrong but cannot unblock revenue. And it's the recognition that the standard has moved, and the audit never moved with it.

The certificate says compliant. The reality is that the audit you paid for was never designed to catch what AI-era buyers care about. To see why, look at what changed in 2022.

For background on what the certification requires, see our ISO 27001 compliance overview. The ISO 27001 audit process in India guide walks through the typical audit flow.

ISO 27001:2022 consolidated Annex A from 114 controls down to 93. It introduced 11 new ones. The revision was published in October 2022. The transition window for existing certificates ran through October 2025.

Any certificate issued after that point is supposed to address the new controls. Any certificate issued before that, against the 2013 control set, is silent on them.

A typical ₹3 lakh audit in India covers clauses 4 through 10 thoroughly. These are the mandatory management system clauses. The audit then runs through Annex A against a fixed checklist.

The auditor tests what is in scope. If your original ISMS scope statement said "we develop SaaS for HR teams" and never mentioned ML, model training, or inference pipelines, the auditor had no reason to test AI-relevant controls.

The Statement of Applicability is where this gap becomes visible. The SoA must list every Annex A control with a justified inclusion or exclusion.

Most SoAs from 2020 to 2023 audits still reference the 2013 control set, with 114 controls. They do not list 5.7 Threat intelligence, 8.10 Information deletion, or 8.11 Data masking. Those did not exist when the audit was performed.

Three things are all true at once. The certificate is real. The scope statement is honest. The buyer's questionnaire is unanswered.

None of these are lies. They are artifacts of an audit that ran before the standard caught up to the threat model.

These 11 controls are not theoretical. They map to the failure modes your buyer's ML systems are built to defend against.

For a breakdown of what full certification costs in India today, the ISO 27001 certification cost in India reference helps. For the technical detail on each new control, our ISO 27001:2022 new controls explained post goes control by control.

The new controls cluster into three functional groups, and the grouping is the part most compliance teams miss.

Data lifecycle controls handle training data and model outputs: - 8.10 Information deletion covers purging training data on request and at end of life - 8.11 Data masking covers PII protection in datasets and embeddings - 8.12 Data leakage prevention covers model output leakage and training data exfiltration

Runtime defense controls cover the systems that run ML workloads: - 8.16 Monitoring activities covers model drift, performance degradation, and anomaly detection - 8.23 Web filtering covers data exfiltration via inference APIs - 8.28 Secure coding covers ML pipeline code security and supply chain

Infrastructure and resilience controls cover the platforms underneath: - 5.23 Cloud services security covers vendor and shared-responsibility risk - 5.30 ICT readiness for business continuity covers disaster recovery for inference - 7.4 Physical security monitoring covers data center surveillance - 8.9 Configuration management covers baseline integrity for training environments

The outlier is 5.7 Threat intelligence, a single control that asks whether you consume feeds about adversarial ML, model extraction, and prompt injection. Buyers ask about this control first, because it signals whether you know the threat landscape exists.

The pattern matters. These are runtime and data-lifecycle controls, exactly the layers where AI and ML systems break. A traditional ISO 27001 audit that focused on access control, HR security, and physical access tested the perimeter. The new controls test the workload.

If you are also evaluating SOC 2, the SOC 2 vs ISO 27001 comparison explains how the two frameworks overlap on AI risk. The ISO 27001 Annex A control reference gives the full text of each new control.

Mapping these controls to your AI risks is where most compliance teams stall. The controls don't mention "AI" or "ML" at all.

Here is the part that frustrates most compliance officers. The controls are technology-neutral. Annex A never says "machine learning" or "model." It says "information," "configuration," and "monitoring activities." The mapping work is yours to do, and yours to evidence.

Bias in training data maps to 8.11 Data masking for handling sensitive attributes. It maps to 8.10 Information deletion for right to erasure on training records. It maps to 5.7 Threat intelligence for consuming feeds about bias disclosures in public datasets.

Data poisoning maps to 8.9 Configuration management for model versioning integrity. It maps to 8.28 Secure coding for hardening the training pipeline against injected code. It maps to 5.7 Threat intelligence for knowing what poisoning attacks look like.

Model drift maps to 8.16 Monitoring activities. The control requires documented thresholds, escalation paths, and response playbooks. "We monitor" is not enough. You need a defined delta that triggers an alert. You need a defined alert that triggers a response. You need a defined response that triggers remediation.

Training data leakage maps to 8.12 Data leakage prevention. The policy must be scoped to model outputs and training data stores, not just email and endpoints. Your DLP tool almost certainly does not cover inference responses or embedding stores today.

Adversarial inputs map to 5.7 Threat intelligence and 8.23 Web filtering on inference endpoints. The filtering piece catches prompt injection and adversarial example submissions before they reach the model.

Without this mapping, the SoA is a checkbox exercise. The buyer's security team will see through it in minutes.

They have read the same control text. They know what "applicable" looks like when it is real.

For how SOC 2 reports miss similar buyer sections, see Why Your SOC 2 Type 2 Report Misses 4 Buyer Sections. To revisit the full audit flow, the ISO 27001 audit process in India breakdown helps. Our ISO 27001 compliance overview also gives the structural picture.

The fix is faster than most teams expect, and it does not require starting the certification clock over.

The fastest path is a five-step sprint.

Step 1: Re-scope the ISMS. Include AI and ML systems explicitly in the scope statement, or formally document their exclusion with a risk-based rationale in the SoA. "We don't have AI" is not a risk-based rationale. "Our model outputs are non-sensitive and our training data is synthetic" is.

Step 2: Rewrite the SoA entries for all 11 new controls. Each entry needs an applicability statement specific to your AI workloads. Generic "not applicable" entries copied from a template will not work. For excluded controls, the rationale must reference a documented risk decision.

Step 3: Build the evidence pack. This step takes time. You need: - Threat intelligence feed subscriptions with documented coverage of adversarial ML - DLP policies scoped to model endpoints and training data stores - Model monitoring dashboards with documented thresholds and response playbooks - Secure coding standards for ML pipelines, including dependency review - Configuration baselines for training environments with drift detection

Step 4: Pre-answer the buyer's questionnaire. Map each common question to a SoA control and an evidence artifact. When the buyer's security team asks about drift monitoring, you point to control 8.16, your monitoring dashboard, and your response playbook. Three artifacts, one answer.

Step 5: Commission a surveillance audit focused on the new controls. A targeted surveillance audit re-tests the new controls and updates the certificate's coverage. No full re-scope needed.

This is different from SOC 2. SOC 2 has its own AI trust services criteria, but those cover AI governance at a principles level. ISO 27001:2022's controls map to runtime AI risks and are directly testable.

For selling into European and APAC enterprise buyers, ISO 27001 is the more widely recognized baseline. The new controls are what your buyer's security team is trained to look for.

For cost benchmarks across both frameworks, our ISO 27001 cost in India page is updated for 2026. The SOC 2 vs ISO 27001 comparison is worth a second read if you are deciding which framework to invest in next.

The compliance teams winning enterprise deals in 2026 are not the ones with the cheapest certification. They are the ones whose ISMS can answer the buyer's AI risk questions on the first pass.

Security review cycles compress. The buyer's questionnaire lands in your inbox and the answers are already in the SoA.

The back-and-forth that typically takes weeks shrinks to days because the evidence is pre-mapped.

Deals that previously stalled at "internal security review" close. The buyer's security team was never blocking on your product. They were blocking on the absence of an artifact they could not produce for their own internal sign-off.

Once the artifact exists, the path clears.

The compliance function shifts from cost center to revenue enabler. The ISMS becomes a sales asset, not a sunk cost. Every new enterprise prospect who sends a questionnaire is a controlled conversation, not a fire drill.

Credibility compounds with regulated buyers. Banks, insurers, and healthcare enterprises all have AI governance requirements layered on top of information security baselines. The teams whose ISMS already covers the new controls have a head start on those layered requirements.

For the structural view of what a working ISMS contains, our ISO 27001 compliance overview is the starting point.

What are the 11 new controls in ISO 27001:2022? ISO 27001:2022 consolidated Annex A from 114 to 93 controls and added 11 new ones: 5.7 Threat intelligence, 5.23 Information security for use of cloud services, 5.30 ICT readiness for business continuity, 7.4 Physical security monitoring, 8.9 Configuration management, 8.10 Information deletion, 8.11 Data masking, 8.12 Data leakage prevention, 8.16 Monitoring activities, 8.23 Web filtering, and 8.28 Secure coding.

How much does an ISO 27001 audit cost in India? A typical full certification audit for an Indian SMB runs in the low lakhs, with ₹3 lakh as a common reference point for companies with 50-200 employees. A targeted gap assessment scoped to the 11 new 2022 controls is usually enough if your ISMS scope already covers the relevant systems.

Do I need a fresh ISO 27001 audit to cover AI controls? Not always. If your ISMS scope and Statement of Applicability already include the systems handling AI/ML data and inference, a surveillance audit focused on the 11 new controls is typically enough. If AI systems were formally excluded from scope, re-scope before the next certification cycle and re-test those controls.

SOC 2 vs ISO 27001, which covers AI risks better? SOC 2's AI trust services criteria cover AI governance at a principles level. ISO 27001:2022's 11 new controls, including data masking, DLP, monitoring activities, secure coding, and threat intelligence, map to runtime AI risks and are testable. For selling into European and APAC enterprise buyers, ISO 27001 is the more widely recognized baseline.

How long does it take to update the SoA for the new 2022 controls? Most teams complete a targeted SoA rewrite and evidence pack in 30 days when AI systems are added to scope, longer if new tooling or threat intelligence feeds must be sourced first.

If your certificate predates the 2022 revision, our ISO 27001:2022 new controls explained guide shows which gaps to close first.