---
title: "ISO 27001 vs SOC 2: Key Differences, Benefits, Which to Choose"
description: "ISO 27001 vs SOC 2 explained. Learn the differences, similarities, and how to choose the right compliance standard for your business growth"
canonical: "https://axipro.co/iso-27001-vs-soc-2-understanding-the-key-differences/"
language: "en-US"
modified: "2026-05-13T08:35:23+00:00"
generator: "WordPress 7.1.2"
---

[Home](https://axipro.co)

/ [All Blog](https://axipro.co/category/blog/)

/ ISO 27001 vs SOC 2: Understanding the Key Differences and Choosing the Right Standard

# ISO 27001 vs SOC 2: Understanding the Key Differences and Choosing the Right Standard

![Picture of Thatware](https://secure.gravatar.com/avatar/?s=300&d=mm&r=g)

- Thatware
- January 2, 2026

Copy Link

Every enterprise sales cycle now passes through a security questionnaire, and two names keep surfacing on it: **ISO 27001** and [**SOC 2**](/soc-2). Both prove a vendor handles data responsibly. Both unlock procurement gates. Yet they are not the same framework; they do not carry the same weight in every region, and choosing the wrong one first can cost a company months of work and a major deal.

The short version: ISO 27001 is an international **certification** built on a risk-managed Information Security Management System (ISMS). SOC 2 is a North American **attestation** that examines how specific controls operate against the [AICPA’s Trust Services Criteria](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2). Most growing technology companies eventually need both. This article explains how to sequence them without doubling the work.

![ISO 27001 vs SOC 2 Understanding the Key Differences and Choosing the Right Standard](https://axipro.co/wp-content/uploads/2025/12/ISO-27001-vs-SOC-2-Understanding-the-Key-Differences-and-Choosing-the-Right-Standard.png)

Every organization that stores, processes, or handles customer data has a responsibility to protect that information. Today, customers, partners, and investors expect clear proof that your security controls are effective and independently validated.

Two of the most commonly requested security frameworks are ISO 27001 and [SOC 2](https://axipro.co/soc-2/). While both focus on protecting information and building trust, they serve different purposes, markets, and business needs.

##### TL;DR

ISO 27001 and SOC 2 both prove that an organization protects customer data, **but they serve different markets.**

**ISO 27001 is internationally recognized** and anchored in a risk-based ISMS. **SOC 2 is a North American** attestation that reports on operational controls over time.

**Scaling SaaS and technology companies typically pursue both** to remove sales friction across regions, and with the right approach, the two can be implemented in parallel.

## **What ISO 27001 Actually Means for a Modern Business**

**ISO 27001** is the international standard for information security management, published jointly by the [International Organization for Standardization](https://www.iso.org/standard/27001) and the International Electrotechnical Commission. It defines the requirements for building, running, and continually improving an **Information Security Management System**.

What separates ISO 27001 from a checklist is its insistence on *governance*. The standard does not just ask whether encryption and access controls are in place. It asks whether leadership has identified the risks the business actually faces, assigned ownership, documented the decisions, and put a continuous improvement cycle in motion. Controls are the visible output. The **ISMS is the engine underneath**.

The standard is built in two parts. **Clauses 4 through 10 are mandatory** and cover context, leadership, planning, support, operation, performance evaluation, and improvement. There is no tailoring these; every certified organization must satisfy them. **Annex A** then lists **93 reference controls** in the 2022 revision, organized into four themes: Organizational, People, Physical, and Technological. An organization is not required to implement all 93, but it must *consider* each one and document its choice in a **Statement of Applicability**, justifying every exclusion against the risk assessment.

Certification involves a two-stage audit by an accredited certification body. Stage 1 reviews documentation and readiness. Stage 2 examines whether the ISMS operates in practice. A successful outcome produces a certificate valid for three years, with annual surveillance audits in between. [Learn more about the ISO 27001 process here](https://axipro.com/iso-27001).

## What SOC 2 Is, and Where It Comes From

![what is soc 2](https://axipro.co/wp-content/uploads/2025/12/what-is-soc.png)

**SOC 2** was developed by the American Institute of Certified Public Accountants (AICPA). It evaluates how a service organization handles customer data against five **Trust Services Criteria**: security, availability, confidentiality, processing integrity, and privacy.

*Security is the only mandatory criterion.* The other four are scoped in based on what the business actually does. A platform processing payments may add processing integrity. A health technology vendor will almost always include confidentiality and privacy. The flexibility is intentional, and it is one reason SOC 2 has become the default trust framework for North American technology vendors.

A SOC 2 engagement produces an **attestation report**, not a certificate. The report is prepared by an independent CPA firm and describes, often in detail running past 80 pages, how each control is designed and whether it operates as intended. SOC 2 comes in two forms:

**Type 1** evaluates the *design* of controls at a single point in time.

**Type 2** evaluates the same controls’ *operating effectiveness* over a period, usually three to twelve months, and is what most enterprise buyers expect.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## Key Similarities and Differences Between ISO 27001 and SOC 2

![Similarities Between ISO 27001 and SOC 2](https://axipro.co/wp-content/uploads/2025/12/Similarities-Between-ISO-27001-and-SOC-2.png)

Both frameworks aim at the same outcome: proving to customers, partners, and regulators that an organization handles data responsibly. They share a common foundation of practices that any mature security program will recognize.

Risk management sits at the center of both. So do access control, secure development practices, vendor management, incident response, employee security awareness, and physical and environmental security. The control overlap between ISO 27001 Annex A and SOC 2’s Common Criteria is widely estimated at around **80 percent**, which is why companies pursuing both rarely have to rebuild controls for the second framework. They scope, evidence, and audit them again.

The differences sit in *structure* and *intent*. ISO 27001 wraps the controls inside a formal management system with documented policies, internal audits, and management reviews. SOC 2 focuses on the controls themselves and how convincingly they can be evidenced to an auditor over a defined period.

There is also a meaningful difference in *scope flexibility*. SOC 2 lets an organization pick which of the five Trust Services Criteria to include, and many companies start with only the mandatory Security criterion. ISO 27001 has no equivalent shortcut: every one of the 93 Annex A controls has to be considered, even if the conclusion is that the control does not apply. *In practice, this means ISO 27001 generally requires more breadth of work upfront, while SOC 2 lets a vendor scope the engagement more tightly to the services that matter to customers.*

Despite their similarities, ISO 27001 and SOC 2 differ in several important ways.

##### Geographic Recognition: Why Region Drives the Decision More Than Anything

Most comparison guides treat geography as a footnote. It is not. It is usually the single biggest factor in which framework a company should pursue first. *The fastest way to waste a year of compliance work is to certify against a standard your customers do not actually recognize.*

**SOC 2 is a North American framework.** It was created by a US accounting body, the criteria are written in the language of US audit standards, and reports are delivered by licensed CPAs. *It is recognized beyond North America*, particularly by global firms with US parent companies, but it is not the dominant standard outside that region. In the United States and Canada, **SOC 2 Type 2 has become the default expectation** for any SaaS or cloud vendor selling into the mid-market or enterprise. Procurement teams in financial services, healthcare technology, and legal technology in particular treat the report as a baseline. A vendor without one is not automatically disqualified, but they will be asked to complete hundreds of questionnaire items the report would have answered on its own, often stretching a deal cycle by weeks.

**ISO 27001 is the standard almost everywhere else.** Across Europe, the United Kingdom, the Middle East, India, Japan, Australia, and most of Southeast Asia, it is the certification enterprise buyers ask for first. The numbers make the point. According to the most recent [ISO Survey](https://www.iso.org/the-iso-survey.html), valid ISO/IEC 27001 certificates worldwide nearly doubled in a single year, jumping from 48,671 in 2023 to **96,709 in 2024**. China alone accounts for more than 33,000 of those certificates. Japan, Italy, the UK, India, and Germany sit consistently in the top ten. The United States is on the list, but its share is small relative to its economy, a clear reflection of how dominant SOC 2 remains in the American market.

The cross-border picture is where things get expensive. A European SaaS company selling into the United States almost always finds that ISO 27001, even with a strong Statement of Applicability, is not enough on its own. A North American company expanding into Europe runs into the same issue: ISO 27001 is requested in the first vendor assessment, and a SOC 2 report alone tends to invite follow-up questions about certification and accreditation that slow the process down.

The **Middle East** deserves a specific mention. Government tenders and large enterprise procurements across the UAE, Saudi Arabia, and Qatar consistently require ISO 27001, increasingly alongside local frameworks such as the UAE Information Assurance Standards or the Saudi NCA Essential Cybersecurity Controls. SOC 2 is recognized in the region, but it does not carry the same procurement weight on its own.

For **Asia-Pacific**, the pattern is fragmented but ISO-leaning. Japan and South Korea were early adopters of ISO 27001 and remain among the most certified countries per capita. Singapore, India, and Australia treat ISO 27001 as the working standard for enterprise and government work. SOC 2 shows up mainly when the customer is itself a North American multinational or operates in financial services.

The practical takeaway is simple. Before committing to a framework, answer three questions:

*Where are your top ten target accounts headquartered? Which framework has appeared most often in your last twenty security questionnaires? And which markets do you expect to expand into over the next two years?*

The answers usually point clearly to one framework first, with the other following soon after.

##### Certification vs Attestation: What You Actually Walk Away With

The deliverable at the end of each process is different, and the difference matters for how it is used in sales.

ISO 27001 produces a **certificate** issued by an accredited certification body, typically a single page that confirms the ISMS meets the standard, lists the scope, and shows validity dates. It is easy to share, easy to verify against the accreditation body’s register, and instantly recognizable to international buyers.

SOC 2 produces an **attestation report** that can run from 50 to over 100 pages. It includes a description of the system, the auditor’s opinion, every control tested, the tests performed, and any exceptions identified. *The depth is the point.* Buyers in regulated industries want to read how each control is designed and whether it operated as expected over the audit period. SOC 2 reports are typically shared under NDA, which is why a public-facing **SOC 3 report**, a stripped-down summary version, often accompanies them.

## Which Is Right for You: ISO 27001 or SOC 2?

![which is righ soc 2 iso 27001](https://axipro.co/wp-content/uploads/2025/12/which-is-righ-soc-2-iso-27001.png)

The honest answer is that it depends on customer base and growth plans. There is no universally right starting point, but there are clear patterns.

If top customers and pipeline sit in the United States and Canada, particularly in SaaS, fintech, or healthtech, **start with SOC 2 Type 2**. It is what buyers expect, what their procurement systems are wired to receive, and what will unlock deals fastest.

If customers are in Europe, the UK, the Middle East, India, or most of Asia-Pacific, **start with ISO 27001**. It carries weight in regulated procurement, satisfies enterprise vendor management programs, and positions the company for global expansion.

If a company sells across both regions, the question becomes which market it is prioritizing in the next twelve months. *The framework to pursue first is the one that unblocks the most revenue.*

## **When Pursuing Both Makes Strategic Sense**

Most companies that scale past the early growth stage end up needing both certifications, and the smart move is to plan for that from the start rather than treat each as a separate project.

The control overlap means a well-designed ISMS already covers the vast majority of SOC 2’s Common Criteria. Risk assessments, policy frameworks, access controls, incident response, and vendor management satisfy both. The incremental work for the second framework is typically scoping, evidence collection, and audit coordination, not building new controls from the ground up.

A combined approach also reduces audit fatigue. Pursuing the two frameworks separately, with separate evidence requests, separate auditors, and separate timelines, can easily consume eighteen months of internal effort. Running them in parallel with a unified control framework and a single source of evidence can cut that to nine or ten. [Learn how Axipro runs ISO 27001 and SOC 2 in parallel](https://axipro.com/services).

### Important Note

ISO 27001 and SOC 2 are not interchangeable. A customer who has asked for a SOC 2 Type 2 report will not accept an ISO 27001 certificate as a substitute, and vice versa. Plan for both if the market demands both. Pretending one covers the other is a fast way to lose enterprise deals.

## Can ISO 27001 and SOC 2 Be Achieved Together?

Yes. With the right approach, organizations can pursue ISO 27001 and SOC 2 in parallel.
A unified control framework, shared risk assessment, and aligned documentation can significantly reduce duplication of effort. This is where expert guidance and structured implementation make a major difference.

At Axipro, clients often pursue both frameworks together using a tailored roadmap aligned to their business size, risk profile, and timeline.

## Is ISO 27001 Equivalent to SOC 2?

**No. ISO 27001** and **SOC 2** are not interchangeable.
Customers requesting ISO 27001 certification typically will not accept a SOC 2 report as a substitute, and vice versa. Each framework serves a distinct purpose and market expectation.

## Are ISO 27001 or SOC 2 Mandatory?

Neither ISO 27001 nor SOC 2 is legally mandatory. However, they are often **commercially required**.

Many organizations will not onboard vendors or partners without seeing proof of compliance, making these standards essential for growth, not just security.

## How Axipro Helps You Get ISO 27001 and SOC 2 Faster

##### 3. Inadequate Risk Assessment

Achieving ISO 27001 and SOC 2 can feel complex, time-consuming, and overwhelming without the right support.

Axipro simplifies the process through:
**• Tailored [gap analysis](https://axipro.co/mastering-gap-analysis-the-key-to-compliance-excellence/) and risk assessment**

**• End-to-end control implementation**

**• Policy and procedure creation**

**• Audit readiness and external auditor coordination**

**• Ongoing compliance support**

Through Axipro’s Achievement Plan, many clients reach certification readiness in as little as six weeks, combining expert human guidance with leading compliance automation platforms like Drata, Vanta, Secureframe, and Sprinto.
Rather than replacing automation tools, Axipro helps organizations maximize their value and avoid common pitfalls that delay audits.

## Final Thoughts

**ISO 27001** and **SOC 2** are both powerful trust signals that demonstrate your commitment to security and risk management. The right choice depends on your customers, geography, and growth goals — and for many organizations, understanding ISO 27001 vs SOC 2 can reveal that pursuing both is the most strategic path forward.

With the right partner, compliance does not have to slow your business down.
Simplifying compliance. Your success, our priority.

##### Mesh ID Achieves ISO 27001 with Axipro in Just 6 Weeks

##### They provide the best value for money for our ISO 27001 audit readiness. Seriously, if you don't go with Axipro...you made a bad decision.

[READ CASE STUDy](https://axipro.co/mesh-id-achieves-iso-27001-with-axipro-in-just-6-weeks/)

## Frequently Asked Questions (FAQ)

What is the main difference between ISO 27001 and SOC 2?

ISO 27001 is an international certification focused on building and maintaining an Information Security Management System, while SOC 2 is an attestation report that evaluates specific security and operational controls, primarily used in North America.

Is ISO 27001 better than SOC 2?

Neither standard is better overall. ISO 27001 is preferred for global recognition and structured security management, while SOC 2 is often required by North American customers and enterprise buyers. The right choice depends on your market and customer expectations.

Can a company have both ISO 27001 and SOC 2?

Yes. Many organizations pursue both ISO 27001 and SOC 2 to meet global and regional compliance requirements. Since the frameworks share overlapping controls, they can be implemented together efficiently.

How long does it take to achieve ISO 27001 and SOC 2?

Timelines vary based on business size and readiness. Traditionally, ISO 27001 and SOC 2 can take several months, but with expert guidance and automation, organizations can significantly shorten the process.

Are ISO 27001 or SOC 2 legally required?

No, neither ISO 27001 nor SOC 2 is legally mandatory. However, they are often required by customers, partners, or enterprise procurement teams, making them essential for trust and business growth.

Axipro Author

![Picture of Thatware](https://secure.gravatar.com/avatar/?s=300&d=mm&r=g)

### Thatware

- January 2, 2026
- [All Blog](https://axipro.co/category/blog/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [Vanta](https://axipro.co/category/vanta/)

- October 3, 2026

#### [Best Vanta Deployment Service (2026): 7 Partners Ranked](https://axipro.co/best-vanta-deployment-service/)

Vanta can tell you a control is failing within the hour. It cannot rewrite your access review process, decide which systems belong in audit scope, or explain to a CPA why a test that shows red is actually fine. That work falls to people, and choosing the right ones is the difference between a 6-week path to audit readiness and a 6-month slog that ends with your Vanta subscription renewing before you have a report. This guide ranks the 7 best Vanta deployment services for 2026, explains what each one is good at, and covers what most comparison pages skip: how long this really takes, what it costs, and how to spot a partner who’ll hand you a half-configured platform and disappear. What Is a Vanta Deployment Service? A Vanta deployment service is a hands-on engagement where a specialist firm sets up, configures, and operationalizes Vanta so your company reaches audit readiness for one or more compliance frameworks. Vanta itself is a compliance automation and trust management platform: it connects to your cloud, identity provider, code repositories, HR system, and endpoints, then runs automated tests and maps the evidence to frameworks such as SOC 2, ISO 27001, HIPAA, and GDPR. The platform automates evidence collection and continuous monitoring. It doesn’t put controls in place for you. A deployment partner handles the judgment work around the tool: scoping, gap analysis, control mapping, policy writing, risk assessment, remediation of failing tests, and coordination with the audit firm. The best partners also stay on after the audit, because a Vanta instance nobody owns degrades fast. Worth Knowing: Vanta is a software vendor, not an auditor. Vanta is a software vendor, not an auditor. Your SOC 2 report still comes from a licensed CPA firm under AICPA attestation standards, and your ISO 27001 certificate comes from an accredited certification body. A deployment partner sits between the platform and the auditor. 1. Axipro Best for: SaaS and technology companies that want Vanta deployed, controls implemented, and the audit delivered by one accountable team, fast. Axipro is an authorized Vanta partner and a Drata Elite Partner, so its team works inside both leading compliance automation platforms every day. Founded in 2023, it has served 200+ clients from offices in the US, UK, and Bahrain, with a 100% audit success rate across 200+ certified clients. What puts Axipro first is scope. Most Vanta partners configure the platform and leave control implementation to you. Axipro’s Achievement Plan covers the whole path: kick-off and Vanta setup, gap analysis, a full policy and procedure suite, risk assessment and treatment, control implementation, vulnerability scanning, an internal audit, and external audit facilitation with an independent auditor. Clients get a dedicated infosec team over Slack, and the Achievement Plan comes with guaranteed certification. The other reason is speed. Axipro typically reaches SOC 2 readiness in around four weeks and ISO 27001 certification readiness in as little as six. It supports 20+ frameworks, including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CMMC, ISO 42001, and the EU AI Act, plus Gulf frameworks such as NCA ECC and SAMA CSF that most US-only partners cannot cover. Teams that want to test the relationship first can start with the free 30-day Compliance Accelerator Plan, which includes Vanta setup, gap analysis, and policy documentation, and continue into ongoing vCISO and continuous monitoring through the Trust Assurance Plan after certification. Watch for: Axipro is built for companies that want the work done for them. Teams that want a light-touch coaching engagement and plan to run the program in-house will use only part of what it offers. 2. Control and Function Best for: US SaaS companies of roughly 10 to 60 people that want SOC 2 and ISO 27001 run as one fixed-price project. Control and Function is a Denver-based consultancy built around fixed-scope, fixed-price readiness for small SaaS teams that have no compliance department. Its sweet spot is the dual-framework engagement: building SOC 2 and ISO 27001 from one shared control set rather than running two projects back to back. It also covers HIPAA for healthtech and maps ed-tech requirements such as FERPA and HECVAT. The firm is platform-neutral, so it works inside Vanta rather than reselling it, and it is explicit about handing off cleanly to an independent auditor. It’s also one of the few firms here that publishes prices, with readiness coaching starting around $8,000 and full readiness around $15,000. Watch for: The framework range is narrower than larger partners. Companies that need PCI DSS, CMMC, or international frameworks will need a second provider. 3. Neutral Partners Best for: Growing companies that need managed GRC across SOC 2, ISO 27001, CMMC, and FedRAMP without hiring an internal compliance team. Neutral Partners, based in Miami, runs a managed GRC model. It builds and documents the compliance program, tests it through internal audits, and then hands off to the relevant independent assessor: a CPA firm for SOC 2, a certification body for ISO 27001, or a C3PAO for CMMC. It never issues the certificate itself, which keeps the independence question simple. Its framework coverage leans toward regulated and government-adjacent work, including CMMC, FedRAMP, PCI DSS, HIPAA, and HITRUST. That makes it worth a look for defense suppliers and companies selling to the public sector. Watch for: Vanta isn’t its main focus. Ask for recent Vanta deployment examples in your framework before signing. 4. Kobalt.io Best for: Small and mid-sized businesses that want Vanta plus managed security operations. Canada-based Kobalt.io markets itself as one of Vanta’s leading global service partners. Its Vanta practice covers policy and control development inside the platform, custom control mapping where standard controls do not fit, and an applicability review of Vanta’s tests. The broader appeal is its managed security services, which suit companies that want compliance and security operations from the same provider. 5. AuditPeak Best for: Startups that want a readiness and audit-preparation partner focused narrowly on SOC 2. AuditPeak focuses on SOC 2 audit readiness for early-stage companies working in

[Read more](https://axipro.co/best-vanta-deployment-service/)

- [ISO-27001](https://axipro.co/category/iso-27001-2/)

- September 29, 2026

#### [ISO 27001 Consultant vs. Software: Which Is Faster?](https://axipro.co/iso-27001-consultant-vs-software/)

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities. What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

[Read more](https://axipro.co/iso-27001-consultant-vs-software/)

- [AI Security](https://axipro.co/category/ai-security/)

- September 27, 2026

#### [Uzbekistan AI Regulation 2026: Law ZRU-1115 Explained](https://axipro.co/uzbekistan-ai-regulation/)

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

[Read more](https://axipro.co/uzbekistan-ai-regulation/)

WhatsApp us