Your next enterprise client will ask for your ISO 27001 certificate before discussing AI integration. Annex A of the 2022 revision includes 93 controls across organisational, people, physical, and technological domains — and every one of them applies differently when your infrastructure includes GPU servers running AI models. Organisations deploying self-hosted AI must map these controls specifically to model hosting, inference pipelines, and the unique risks that GPU workloads introduce.
Risk Assessment for AI Infrastructure
ISO 27001 Clause 6.1 requires a risk assessment methodology. For AI GPU infrastructure, the asset inventory must include model weights (often representing millions in training investment), training datasets, inference logs, GPU hardware, and the software stack from drivers through to the API layer. Each asset carries distinct threat profiles:
| Asset | Primary Threats | Impact Level |
|---|---|---|
| Model weights | Theft, unauthorised copying, reverse engineering | High — IP loss |
| Inference logs | Data breach, unauthorised access | High — may contain PII |
| GPU hardware | Physical access, side-channel attacks | Medium |
| API endpoints | DDoS, injection, credential theft | High — service disruption |
| Training data | Poisoning, exfiltration | High — model integrity |
Score each risk using your chosen methodology (likelihood x impact) and document treatment decisions. Dedicated GPU servers inherently reduce shared-infrastructure risks compared to cloud GPU instances.
Key Annex A Controls for GPU Hosting
The 2022 revision reorganised controls into four themes. The most relevant for AI infrastructure include A.5.1 (policies for information security) requiring an AI-specific security policy, A.8.1 (user endpoint devices) covering developer workstations accessing GPU servers, A.8.3 (information access restriction) requiring RBAC on model endpoints, and A.8.24 (use of cryptography) mandating encryption for model weights and inference data.
New controls added in 2022 are particularly relevant: A.5.7 (threat intelligence) should include AI-specific threats like model extraction attacks and prompt injection. A.8.16 (monitoring activities) must cover GPU utilisation anomalies that could indicate unauthorised model use. A.8.23 (web filtering) applies to inference API endpoints exposed to the internet.
Access Management for AI Systems
A.5.15 through A.5.18 cover access control. For GPU servers running AI models, implement tiered access: infrastructure administrators manage the server and drivers, ML engineers deploy and update models through vLLM, application developers access inference endpoints only through authenticated APIs, and monitoring teams view logs and metrics without inference access.
SSH key management is critical — see the SSH hardening guide for GPU servers. Use certificate-based authentication rather than password auth. Log all administrative access with immutable audit trails. Privileged access reviews should occur quarterly, documented as evidence for certification audits.
Operational Security Controls
A.8.9 (configuration management) requires documented baseline configurations for GPU servers. Capture your NVIDIA driver version, CUDA toolkit version, model versions, vLLM configuration, and firewall rules in version-controlled configuration files. Any change must follow the change management process under A.8.32.
A.8.15 (logging) requires comprehensive audit trails. For AI systems, log every inference request (timestamp, source IP, model used, token count), every model deployment or update, every configuration change, and every administrative access session. Store logs on separate infrastructure from the GPU server — a compromised inference server should not be able to tamper with its own audit trail.
Preparing for Certification Audit
Stage 1 audits review documentation. Have your Statement of Applicability ready, with clear justifications for any controls you have excluded. AI-specific policies should cover model lifecycle management, inference data retention, and GPU infrastructure patching schedules.
Stage 2 audits test implementation. Auditors will want to see live demonstrations of access controls on the GPU server, evidence of regular vulnerability scanning, incident response procedures tested through tabletop exercises, and backup and recovery tested for model weights and configuration. GDPR-compliant hosting documentation strengthens your privacy control evidence. Reference production use cases to demonstrate operational maturity.
Maintaining Certification
ISO 27001 requires continual improvement through the Plan-Do-Check-Act cycle. Schedule internal audits of your AI infrastructure biannually. Track security metrics: patching cadence for NVIDIA drivers and CUDA, mean time to respond to GPU server alerts, and access review completion rates. Surveillance audits occur annually — keep your evidence current. Teams running AI chatbots or vision models should include these workloads in scope from the outset.
ISO 27001-Ready GPU Infrastructure
Dedicated GPU servers with the access controls, logging, and isolation required for ISO 27001 certification of AI workloads.
Browse GPU Servers
