Plain answer

Does ISO 27091 replace ISO/IEC 42001?

No. ISO/IEC 42001:2023 is the AI management system standard a certificate is issued against. ISO/IEC FDIS 27091 is guidance on privacy protection, and on the public record it sits beside the management system rather than replacing it.

What 42001 is

ISO/IEC 42001:2023 sets requirements for an AI management system, with Annex A controls covering policy, roles, resources, impact assessment, the AI system lifecycle, data, information for interested parties, use and third parties. A certification body can audit against it.

What 27091 is

The draft provides guidance on privacy risk in AI systems and machine learning models. The abstract describes identification, evaluation and treatment across the lifecycle. It is a first edition and, on the public record, guidance.

The relationship

The control pages on this site read the 42001 Annex A set because those controls apply today. The 27091 overlay shows where the draft's privacy direction lands on each control. The two are read together, not substituted for one another.

What to tell an auditor

Tell them which certificate you hold and against which edition, and show the privacy work as part of that system. Do not describe the draft as a certification, and do not claim a transition that has not been published.