Use AI Safely in ISO 27001 Consulting Engagements

AI can help an ISO/IEC 27001 consultant organise information, prepare interviews, explore alternatives and improve consistency. It cannot take responsibility for scope, risk acceptance, control design, evidence evaluation or professional conclusions. Those decisions depend on client context and accountable human judgement.

The safest approach is to treat AI as a controlled consulting aid. Define approved uses, data boundaries, validation steps and records before using it in client work.

Separate assistance from professional judgement

AI is most useful for bounded tasks where an experienced consultant can evaluate the output. Appropriate examples may include:

• organising public research and authoritative references;
• preparing interview questions from an approved engagement plan;
• summarising non-sensitive notes after accuracy review;
• proposing alternative structures for original working drafts;
• comparing client-supplied lists for omissions or inconsistencies;
• creating first-pass traceability between already identified items;
• improving plain-language explanations; and
• identifying issues for a consultant to investigate.

AI should not be treated as the authority on what the standard requires, whether a client conforms or which risk is acceptable. It can produce plausible statements that are incomplete, outdated or wrong. It also lacks the consultant’s direct knowledge of interviews, observations, systems and organisational behaviour.

The AI-assisted Annex A guide explains similar boundaries from the implementer’s perspective. A consulting engagement adds client confidentiality, contractual duties and independence concerns.

Classify use cases before adoption

Create risk tiers for intended AI uses. Consider the sensitivity of inputs, consequence of an incorrect output, client commitments, tool behaviour and degree of human review.

Use case	Main risk	Minimum control direction
Public-source research	Outdated or invented information	Verify against current primary sources
Interview preparation	Generic questions that miss context	Consultant tailors to scope and risk
Client-note summarisation	Confidentiality loss or omitted nuance	Approved environment, minimised input, source comparison
Drafting client-specific content	False requirements and ownership loss	Human authoring, client validation and controlled revision
Evidence analysis	Misinterpretation or hidden omission	Preserve originals and independently inspect samples
Finding formulation	Unsupported conclusion or bias	Auditor or consultant owns criteria, evidence and conclusion

Prohibit uses whose risk cannot be controlled. Examples can include entering secrets into an unapproved public service, asking a model to make an unattended conformity decision or presenting generated citations without opening the sources.

Establish a client-data boundary

Before using a tool, determine what information it receives, how it is processed, whether it is retained, who may access it and whether it is used to improve models. Review relevant contractual, privacy, location and deletion terms.

Classify engagement information and define what may be entered. Client policies, network diagrams, vulnerabilities, personal information, credentials and audit evidence may require restrictions or exclusion. Redact or generalise only when doing so preserves the task’s meaning.

Use an organisation-approved account and configuration. A consultant’s personal account can bypass contractual controls, retention decisions and offboarding. Restrict connectors and plug-ins that may expose data to additional services.

Record the approved purpose, tool, data categories, owner and review date. If the tool or terms change, reassess the use.

Protect client ownership and accountability

The client should understand where AI materially supports delivery when this affects confidentiality, intellectual property or the agreed method. Contract terms or engagement rules may need to address permitted tools, data handling, subcontracting, output ownership and notification of material change.

AI must not displace client ownership of the ISMS. A policy that the client cannot explain or operate is weak regardless of its wording. Use working sessions to capture actual decisions, assign owners and confirm that content matches business practice.

The ISO 27001 consulting engagement guide shows how discovery, implementation and assurance can preserve client decisions and evidence.

Ground every requirement claim

Use licensed standards and authoritative public sources. Record the source and edition behind a claim, then verify it before delivery. Do not ask AI to reproduce copyrighted standard text or infer an exact requirement from memory.

Distinguish four kinds of content:

• normative requirement: what the applicable standard requires;
• control guidance: advice from supporting standards or authorities;
• client decision: the organisation’s chosen scope, method or treatment; and
• consultant recommendation: an evidence-based proposal for the client to decide.

Generated output often blends these categories. Label them explicitly so a recommendation is not mistaken for a mandatory clause.

The ISO 27001 clause explainer can support orientation, but the applicable licensed standard and engagement criteria remain authoritative.

Use traceable prompts and source records

For material work, retain enough information to reproduce the consulting decision. This does not mean saving every conversation. A controlled record can include:

• task and permitted use case;
• approved source documents or data categories;
• key instruction or prompt version;
• tool and relevant configuration;
• output version used in the working paper;
• reviewer and validation performed;
• corrections or rejected content; and
• final client decision or deliverable reference.

Do not let the AI conversation become the only evidence. Preserve original interview notes, system exports, records and observations separately. Generated summaries are secondary working material.

Validate with a four-part review

Factual validation

Open sources and confirm editions, dates and claims. Reject invented quotations, control numbers, transition deadlines and certification statements.

Context validation

Compare the output with scope, interested parties, risk criteria, obligations, technology and actual working practices. Generic material can be correct in principle and wrong for the client.

Evidence validation

Trace every audit or readiness conclusion to evidence. Confirm that the evidence covers the right population and period and shows operation, not merely an approved document.

Editorial validation

Remove repetition, unsupported certainty and vague language. Ensure roles, actions and records are understandable to the people who must operate them.

The reviewer should be competent for the subject and independent enough to challenge the output. High-impact conclusions may need a second reviewer.

Apply AI at each engagement stage

Discovery

AI can organise an approved document inventory, propose interview themes and identify apparent inconsistencies. The consultant still confirms scope, objectives, stakeholders and evidence sources through client interaction.

Assessment

AI can help group observations or compare supplied records, but it should not issue findings. The consultant applies criteria, samples evidence, tests operation and distinguishes nonconformity, risk, observation and improvement.

Implementation support

AI can assist with original working drafts and action structures. Owners must decide policy direction, control design, acceptance and responsibilities. Test whether the resulting process works in normal operations.

Assurance preparation

AI may help index evidence or identify missing links. It must not manufacture records, rewrite dates or conceal gaps. The purpose is to improve traceability, not create the appearance of operation.

Audit the AI-assisted consulting process

Select samples across use-case risk levels and clients. For each sample, trace approval, input classification, source grounding, review and final use.

Useful questions include:

• Was the tool and use case approved before client data was entered?
• Which data categories were processed, retained or excluded?
• Can the consultant show the primary evidence behind the conclusion?
• Which errors or limitations were found during review?
• Did the client make and understand its own ISMS decisions?
• Were generated citations, clause claims and dates independently verified?
• Can access be revoked and client data deleted when required?

A pass is supported when permitted uses and data boundaries are clear, material outputs are source-grounded, competent humans validate them and client ownership remains visible.

A partial result may exist when review occurs but records are inconsistent, individual consultants use unapproved accounts or disclosure terms are unclear.

A fail is likely when confidential evidence enters an unapproved service, generated conclusions replace evidence or unsupported output is delivered as authoritative.

Use the ISO 27001 readiness checker to structure client discussions, while ensuring the consultant independently verifies every conclusion used in the engagement.

Govern improvement

Track recurring AI errors, rework, data incidents, prohibited-use attempts and time spent validating output. These are organisation-specific management signals, not standard-mandated metrics. Update permitted uses, instructions and training when patterns emerge.

The NIST AI Risk Management Framework provides voluntary guidance for managing trustworthiness risks, including a profile for generative AI. The official ISO/IEC 42001 overview describes requirements for an AI management system. They can inform governance without turning AI output into ISO 27001 evidence.

AI adds value when it makes a competent consultant more systematic and leaves a clearer trail. It creates risk when speed obscures evidence, context or responsibility.