ISO 42001 sets the stage for responsibly managing AI systems within organizations. Taken together, ISO 42001 controls and policies represent the first international AI management system standard. With the proliferation of AI across many industries showing no signs of slowing down, guidance is sorely needed to address potential security, societal, environmental, and other risks posed by the use of AI.
Security concerns around AI are top of mind for many organizations at the moment. Recently, companies like Samsung have gone as far as banning the internal use of generative AI tools after a data leak with ChatGPT. Meanwhile, consumers are becoming increasingly concerned about how companies utilizing AI systems handle their data.
ISO 42001 aims to provide clarity around how organizations can responsibly use AI. Adherence to ISO 42001 controls sends a strong signal that an organization takes the security component of AI seriously. It is the most comprehensive attempt to date to provide clear requirements for implementing and continually managing the use of artificial intelligence. In this article, we go over what it is, who it applies to, and what businesses need to do to implement it.
Who Does ISO 42001 Apply To?
ISO 42001 is a voluntary standard. There are no legal obligations to adhere to it. However, it becomes a must-have for many organizations once their prospects and clients start asking for evidence and reassurance that their data is being safely handled by systems using AI.
Given the wave of media hype around AI, and the rapid improvement of the technology itself, many organizations have started to ask serious questions about the potential risks.
The standard applies to any organization developing or providing products or services that utilize AI systems. Based on official guidelines, ISO/IEC 42001 is for:
“Organizations of any size involved in developing, providing, or using AI-based products or services. It is applicable across all industries and relevant for public sector agencies as well as companies or non-profits.”
The implementation of ISO 42001 controls, as well as the responsibilities within the management of AI systems, can vary depending on the individual organization.
What Do Businesses Need To Do To Implement ISO 42001 Controls?
The standard is quite robust but can be summarized into three main action items that organizations must complete in order to implement it. There is a clear focus on risk assessment, the role of governance, and compliance as a continuous process rather than a “check the box” item for businesses. The focus on these trends is reflected across the standard’s three main components:
1. Create An AI Management System
A key component of ISO/IEC 42001 is the concept of an Artificial Intelligence Management System (AIMS). An AI management system is a documented system an organization uses to establish and enforce policies that manage assets using AI.
The AI management system also establishes objectives related to the use of AI and creates processes to achieve them. The goal is to have a set strategy for responsibly managing AI that is applied across the organization and aligns with overall business goals.
At a high level, the AI Management System should:
- Align with organizational objectives.
- Define and manage both risks and opportunities associated with AI.
- Oversee the implementation of controls to address AI security risks.
- Manage third-party vendors and partners involved in the development and/or ongoing use of AI systems.
In conjunction with the creation and documentation of an AI Management System, organizations must also conduct an impact analysis (determining the broader potential security and societal impact of AI systems, as well as the impact on business goals), establish clear policies on the use of AI, and implement controls to ensure data is responsibly handled in AI systems.
Lastly, the standard emphasizes the importance of continuous monitoring and improvement of the AI management system.
2. Conduct An Impact Analysis
There is a clear focus on the importance of assessing the societal impacts of AI systems. One of the core controls requires organizations to assess and document the potential impacts of their AI systems in the following areas:
- Environment sustainability (including the impacts on natural resources and greenhouse gas emissions);
- Economic (including access to financial services, employment opportunities, taxes, trade and commerce);
- Government (including legislative processes, misinformation for political gain, national security and criminal justice systems);
- Health and safety (including access to healthcare, medical diagnosis and treatment, and potential physical and psychological harms);
- Norms, traditions, culture and values (including misinformation that leads to biases or harms to individuals or groups of individuals, or both, and societies).
ISO 42001 controls require an AI risk assessment, along with an AI system impact assessment, to be conducted and continuously evaluated. This means that organizations must not only continuously monitor the impact of AI as risks change but must also evaluate the efficacy of their systems intended to mitigate that risk.
3. Implement and Continuously Improve ISO 42001 Controls
There are many areas where controls can be adjusted according to the organization’s industry and needs.
Here is a summary of the standard’s additional controls and overall implementation guidance:
Establish Roles & Responsibilities, and Document AI Policies: Organizations must establish and document clear policies around AI that are aligned with overall objectives and demonstrate a commitment to continuous improvement. Leadership must communicate the importance of AI management across the organization and share resources with employees. The roles and responsibilities related to the AI management system should be made clear, as well as how the AI management system requirements fit into business processes and goals. AI design choices, including machine learning methods, must also be documented.
Address Risks and Opportunities: Identifying potential risks and establishing a plan to address them is a critical step. This involves conducting an AI risk assessment and then selecting appropriate risk treatment options, implementing controls, and producing a statement of the applicability of controls. Objectives related to the use of AI, as well as a plan to achieve them, must be established and continuously reassessed.
Provide Organization-Wide Resources and Support: Create and distribute resources necessary for the AI management system and its ongoing improvement. Ensure that employees involved in AI-related activities receive appropriate training and education and that employees are aware of their roles within the AI policies.
Evaluate Performance: This involves ongoing monitoring, analysis, and evaluation of the performance of the AI management system. This can take the form of internal audits, intended to ensure conformity to AI management system requirements across the organization. Reviews of the AI management system must be conducted at planned intervals throughout the year.
Continual Improvement and Corrective Action: This last piece highlights the increasing importance being placed on continuous compliance rather than a “check the box” mentality. This is a shift we are seeing across the board for other requirements and standards, such as in the latest version of NIST CSF with the addition of the NIST Governance function.
In the context of ISO 42001, this means that organizations must continually improve their AI management system and take corrective action to make changes as needed.
In Conclusion: What ISO 42001 and The AI Management System Mean For Businesses
Organizations that adhere to ISO 42001 gain several key benefits. First and foremost, they gain the benefit of responsible use of AI and the peace of mind knowing they can provide evidence of that to any partners, prospects, or other business stakeholders.
As is often the case with other voluntary standards (such as SOC 2), organizations often find that their deals cycle becomes shorter, as prospects’ questions around security are proactively answered and they no longer need to fill out lengthy security questionnaires.
Secondly, organizations gain the benefit of reputation management. Given the focus on mitigating environmental, societal, and economic damage, adherence to ISO 42001 controls serves as a signal that organizations care about their role in these issues and have taken steps to invest in the responsible use of AI. This can have the effect of improving their reputation as reliable, responsible, and trustworthy.
Lastly, there is an enormous benefit in terms of AI governance. ISO 42001 controls map onto laws and regulations around the use of artificial intelligence, allowing organizations to align the use of AI with laws relevant to their industry and location. As one of the first frameworks to directly address AI, ISO 42001 will serve as a baseline for future standards and laws.
Organizations can take a proactive approach by complying with ISO 42001. This saves time and money down the line when other frameworks and laws catch up.
About Rhymetec
Our mission is to make cutting-edge cybersecurity available to SaaS companies and startups. We’ve worked with hundreds of companies to provide practical security solutions tailored to their needs, enabling them to be secure and compliant while balancing security with budget.
We enable our clients to outsource the complexity of security and focus on what really matters – their business. If you are interested in our services, or if you have questions about security, you can contact our team for more information.
About The Author: Metin Kortak, CISO
Metin Kortak is the Chief Information Security Officer at Rhymetec. Metin began his career working in IT security and gained extensive knowledge of compliance and data privacy frameworks such as SOC 2, ISO 27001, PCI, FedRAMP, NIST 800-53, GDPR, CCPA, HITRUST and HIPAA. He joined Rhymetec to build data privacy and compliance as a service offering. Under Metin’s leadership, these offerings have grown to more than 200 customers, positioning the company as a leading SaaS security service provider in the industry.
Interested in reading more? Check out our other blogs: