Being certified to an ISO standard tells you a lot about how well-managed your systems are. It doesn’t tell you whether you’re meeting the law.
ISO standards and legal regulations solve different problems
An ISO standard sets out how a management system should work, which includes the processes, controls, and governance a business puts in place around a specific operational function. A legal regulation sets out what a business is legally required to do in terms of an applicable law.
The two are more closely linked than that distinction suggests. Several ISO standards build legal compliance into their requirements, creating an overlap between the two.
Where the overlap shows
The overlap depends entirely on the business – its industry, the data it processes, and the jurisdictions it operates in.
For example, an ISO 27001 certified organisation has built controls around its information security. But if that information includes personal information, then privacy laws such as the GDPR and POPIA will come with their own requirements, such as obtaining proper consent, responding to access requests, and reporting data breaches. ISO 27001 doesn’t cover these on its own.
Or where an ISO 42001 certified organisation has built controls around its AI management system, a regulation such as the EU AI Act will impose its own obligations, such as risk classification, human oversight and transparency. Requirements that are separate from what ISO 42001 certifies.
Why having both matters
Being ISO certified means the management system is in place. The legal side often isn’t.
ISO certification opens doors, but procurement teams and investors are asking sharper questions about specific regulations, not just “are you certified,” but “can you show us you meet GDPR” or “how are you managing EU AI Act risk.”
A compliance review gives you a direct answer, backed by an independent assessment standard.
What a Sancert compliance review covers
Sancert has launched compliance reviews covering the GDPR, POPIA, the EU AI Act, and DORA. Each review is structured around the specific regulation and assesses your compliance posture against its key obligation areas.
Want to check where you stand on GDPR, POPIA, the EU AI Act, or DORA? Get in touch with us