ISO 27001 and AI Software Development: What It Means for Clients

When a vendor says its processes are ISO 27001 certified, what does that mean for your project? And does it change anything when much of the code is written by coding agents? This article explains the standard in plain terms and shows which questions remain yours to ask.

What ISO 27001 is

ISO 27001 is an international standard that describes how an organization sets up and runs an information security management system. Rather than prescribing specific technologies, it requires an organization to identify its information security risks, choose and apply controls, monitor them and keep improving. Certification means an independent body has assessed that the system meets the standard within a defined scope. That last phrase matters, and we come back to it below.

What it means in everyday project work

• Access control: who can reach your code, data and credentials is deliberate, limited and reviewable.
• Risk management: threats to your project are identified and addressed in a structured way.
• Incident handling: there is a defined path for reporting, analyzing and fixing security events.
• Supplier management: third-party tools and services used in the process are assessed.
• Awareness and discipline: staff are trained, and routines are documented rather than improvised.

Why it matters more with coding agents

Coding agents read files, run commands and may touch credentials, so the way they are used is itself a security question. A controlled process decides which repositories an agent can access, which secrets stay out of reach, whether agent actions run in sandboxes, and which tools may send code to external services. These choices are exactly what a management system should cover. Our piece on secure agentic coding goes into practical measures.

Questions to ask regardless of certification

1. What is the certificate's scope, and does it include the team and location doing your work?
2. Which AI tools and providers process your code, and under which terms?
3. Where is your data stored, and are EU hosting options available?
4. How are secrets stored, rotated and kept away from agents?
5. How are security findings in your project reported and fixed?
6. What happens to your code and data at the end of the contract?

What certification does not do

A certificate describes a management system, not a guarantee about every line of code. An ISO 27001 vendor can still ship a vulnerable app if review is skipped. That is why the human review step is essential, and why it pairs well with a specific security review of the code itself. Treat the certificate as a strong starting signal and the project evidence as the proof.

How apprat.io applies it

jocapps GmbH, the company behind apprat.io, works with ISO 27001 certified information security processes, alongside ISO 9001 for quality management. In practice that means agents are directed by senior AI Code Engineers within defined access rules, every change is reviewed by a person, and security considerations are part of planning rather than an afterthought. GDPR-oriented practices and EU hosting options are available for clients who need them. If your procurement team has a security questionnaire, bring it to the conversation.

Data handling with AI tools

One topic deserves its own attention: what happens to your source code and data when AI tools are involved. Coding agents are typically connected to model providers, and the terms differ between products and plans. Responsible vendors know which tools are approved for client work, how those tools treat submitted code, and whether training on client material is excluded under their terms. They keep production credentials and personal data out of agent sessions altogether, and they use test data instead.

As a client, you can reasonably ask for a list of approved tools, a description of what is shared with them and a commitment about what is never shared. Written answers are better than verbal reassurance, and they make later audits easier. If your sector has additional rules, say so at the start so they can be built into the plan rather than added late.

Using this in procurement

If your organization asks vendors for security evidence, request the certificate, the statement of scope and a short description of how AI tools are controlled in delivery. Compare vendors on that evidence. If you want to walk through your requirements with the team, you can book a call for free, and the broader accountability model is described in AI Development Services.