Does ISO 27001 require specific controls for AI tools?

ISO 27001:2022 (the current edition) introduced several controls relevant to AI tools, including A.5.23 (Information security for use of cloud services) and A.8.25 (Secure development life cycle). AI tools like Claude should be addressed in your risk assessment, included in your asset inventory, managed as a supplier relationship under A.5.19-A.5.22, and covered by appropriate Annex A controls.

How do I include Claude in my ISO 27001 risk assessment?

Include Claude in your asset inventory as an information processing service. Assess risks across confidentiality (data sent to Claude), integrity (accuracy of Claude outputs used in business processes), and availability (dependency on Claude for critical processes). Document your risk treatment decisions (typically: accept residual risk after controls, transfer via contractual protections, or modify by implementing technical controls).

What audit evidence do I need for Claude under ISO 27001?

Key audit evidence for Claude under ISO 27001 includes: Claude in your asset register, risk assessment entry with risk treatment decision, signed DPA/supplier agreement with Anthropic, Acceptable Use Policy covering AI tools, access control records showing authorised users, training records for employees with Claude access, and audit logs for sensitive use cases. Anthropic's SOC 2 Type II report serves as third-party assurance for Anthropic's own controls.

Is Anthropic ISO 27001 certified?

Anthropic maintains SOC 2 Type II certification, which covers security, availability, and confidentiality. For ISO 27001 specifically, check Anthropic's current certification status directly with their enterprise team, as certification status changes over time. For your ISMS, you can use Anthropic's SOC 2 report as third-party assurance for the security controls within Anthropic's environment.

Claude for ISO 27001 Compliance

If your organisation is ISO 27001 certified or pursuing certification, Claude must be addressed within your Information Security Management System (ISMS). This isn't optional — ISO 27001 requires a comprehensive approach to information security that covers all information assets and processing activities, including AI tools.

The good news: Claude's enterprise controls (ZDR, SOC 2 Type II, encryption, DPA) align well with ISO 27001 requirements. The work involved is primarily documentation and integration with your existing ISMS — not building new security controls from scratch.

ISO 27001 Claude Integration Assessment

We audit your existing ISMS, identify gaps in Claude coverage, and produce the documentation needed to satisfy your next audit — in 2 weeks.

Request Free Assessment →

Integrating Claude into Your ISO 27001 Risk Assessment

The risk assessment is the foundation of ISO 27001. Claude must appear as an information asset (or group of assets) in your risk register, with documented risks and treatment decisions.

Claude as an Information Asset

Add Claude to your asset inventory as an "information processing service" or "cloud AI service". Key attributes to document:

Asset owner: The individual or team responsible for Claude governance (typically your CISO or AI governance lead)
Classification: The highest classification of data that Claude is approved to process
Supplier: Anthropic, Inc. (links to your supplier management records)
Business dependency: List of critical business processes that rely on Claude

Risk Assessment: CIA Triad for Claude

Assess risk across the classic confidentiality, integrity, and availability dimensions:

Confidentiality risks: Unauthorised disclosure of information sent to Claude (via account compromise, misconfiguration, or Anthropic data breach). Mitigated by: Enterprise plan with ZDR, access controls, PII minimisation, DPA, employee training.

Integrity risks: Claude outputs containing errors used without adequate review in business-critical processes. Mitigated by: Mandatory human review policies, output validation for high-risk use cases, clear communication to users about AI limitations.

Availability risks: Dependency on Claude causing business disruption if the service is unavailable. Mitigated by: Ensuring Claude is not a single point of failure for critical processes, maintaining manual fallback procedures for critical workflows.

Relevant ISO 27001:2022 Annex A Controls

ISO 27001:2022 (the current version, superseding 2013) introduced several new controls directly relevant to cloud AI tools. Here are the key controls and how they apply to Claude:

A.5.19 / A.5.20 / A.5.21 / A.5.22 — Supplier Relationships

Information Security in Supplier Relationships

Anthropic is a supplier processing your information. You must: document your information security requirements in your agreement with Anthropic (covered by the DPA), monitor Anthropic's security performance (review their annual SOC 2 Type II report), and maintain a supplier register entry for Anthropic.

A.5.23 — Cloud Services

Information Security for Use of Cloud Services

ISO 27001:2022 introduced this specific cloud services control. Implement a policy for the acquisition, use, management, and exit from cloud services. Document Claude's data residency, data handling, and termination/data deletion procedures. Maintain evidence of due diligence before onboarding Claude.

A.5.37 — Documented Operating Procedures

Documented Operating Procedures

Your Claude Acceptable Use Policy and data classification guide serve as documented operating procedures for Claude usage. Ensure these are version-controlled, approved, and accessible to relevant personnel.

A.6.3 — Information Security Awareness and Training

Information Security Awareness and Training

Claude-specific training (what data can be submitted, how to handle outputs, how to report concerns) must be included in your information security awareness programme. Document training completion as audit evidence.

A.8.10 — Information Deletion

Information Deletion

Document your data retention position for Claude. With ZDR enabled, Anthropic does not retain prompt/response data. Document this in your data retention schedule and confirm the position in your DPA review.

🛡️

White Paper: AI Compliance — SOC 2, HIPAA & GDPR

Our 40-page compliance guide includes ISO 27001 integration guidance, Annex A control mapping, and audit evidence templates for Claude deployments.

Download Free →

Supplier Management: Anthropic Due Diligence

ISO 27001 requires ongoing due diligence for suppliers processing your information. For Anthropic, this means:

Initial Due Diligence (Pre-Deployment)

Obtain and review Anthropic's current SOC 2 Type II report
Review Anthropic's privacy policy and security documentation
Execute DPA and review its alignment with your ISMS requirements
Document Anthropic's data residency and sub-processor list
Assess Anthropic's incident notification commitments (typically 72 hours under GDPR-aligned DPAs)

Ongoing Monitoring

Annual review of Anthropic's SOC 2 report (request updated report each year)
Monitor Anthropic's published security advisories and incident communications
Review and re-execute DPA if Anthropic updates its terms materially
Track Anthropic's sub-processor changes (your DPA should require notification of sub-processor changes)

Audit Evidence Checklist

When your ISO 27001 auditor reviews your treatment of Claude, they will typically look for the following evidence. Prepare this documentation before your next audit:

Claude in your asset register with classification, owner, and supplier reference
Risk assessment entry with documented risks (CIA) and treatment decisions
Statement of Applicability (SoA) reflecting Claude-related controls as applicable
Signed DPA with Anthropic — current version, on file
Anthropic SOC 2 Type II report — current, in supplier management file
Claude Acceptable Use Policy — version-controlled, approved, distributed
Data classification guide — including Claude-specific guidance
Access control records — list of authorised Claude users
Training records — completion evidence for all Claude users
Audit logs — for sensitive use cases, demonstrate logging capability
Incident response procedure — Claude-specific section or reference to main IRP

Using Claude to Support Your ISO 27001 Programme

Beyond the compliance requirements, Claude itself can support your ISO 27001 programme — helping you generate documentation more efficiently and maintain your ISMS more systematically.

High-value Claude use cases for ISO 27001 teams:

Drafting and updating ISMS policies (AUP, risk assessment methodology, access control policy)
Creating training materials and awareness content
Risk register formatting and maintenance
Internal audit report drafting from interview notes
Control gap analysis against new control requirements
Corrective action tracking and documentation

Note: Claude outputs for compliance purposes must be reviewed by a qualified ISMS professional before use. AI can dramatically reduce the documentation effort but cannot replace the professional judgement required for genuine risk assessment and control evaluation.