Compliance and security teams face the same question from customers, boards and regulators: who is accountable for AI, and where is the evidence? ISO/IEC 42001:2023 is increasingly the answer firms reach for, though it covers less than many assume.

According to Copla, published by ISO and IEC in December 2023, ISO 42001 is a voluntary, certifiable standard for building and continually improving an AI management system (AIMS).

It governs how an organisation manages AI through policy, risk processes, named roles, oversight and improvement. It does not test models, set accuracy thresholds or approve AI products.

A certificate covers the management system within a defined scope, so marketing a product as “ISO 42001 certified AI” overstates what an auditor examined.

The standard uses the Harmonized Structure behind ISO 27001 and ISO 9001, which gives firms running an information security management system a head start. Clauses 4 to 10 contain the auditable requirements, and Annex A sets out 38 controls across nine objectives. Organisations record which controls they apply or exclude in a Statement of Applicability, giving a reason for each exclusion.

The main feature without an ISO 27001 equivalent is the AI system impact assessment. Under clauses 6.1.4 and 8.4, organisations must assess the consequences of their AI for individuals, groups and society. They must also repeat the assessment at planned intervals and whenever significant changes occur.

Demand comes from several sources. Security questionnaires now include AI sections, procurement teams want proof of AI governance, and boards approving AI projects need clear ownership of risk.

Source link