Since December 2023, ISO/IEC 42001 has provided an international standard describing how organisations steer AI responsibly. It is of interest to companies that develop AI or use it at scale and want to demonstrate this to customers, partners or supervisors.
Structure
The standard follows the common structure of ISO management systems: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. On top come AI-specific controls, for example on policies, roles, resources, impact assessments for AI systems, lifecycle, data quality, information for affected parties and third-party relationships. Organisations select the relevant controls and justify exclusions.
Relation to ISO/IEC 27001
Anyone already running an information security management system under ISO/IEC 27001 will find their way quickly: structure, terms and many processes such as internal audits, management review and document control are comparable. An integrated management system for both standards is possible and reduces duplication.
Relation to the AI Act
ISO/IEC 42001 does not replace AI Act obligations and is not a harmonised standard within the meaning of the Regulation. A management system under the standard does, however, cover many organisational prerequisites: responsibilities, risk processes, documentation, monitoring and improvement. For providers of high-risk systems needing a quality management system it is a good foundation. The technical detail is meant to come from the harmonised standards.
When certification pays off
Certification pays off when customers or tenders require it, when AI is core to your own offering, or when a company in a regulated environment must demonstrate trust. For an SME using AI mainly as a tool, lean AI governance along the standard’s principles is often the better first step.
A pragmatic start
An AI inventory, a policy, clear responsibilities and an approval process for new systems form the core. On that basis the management system can be extended step by step until certification is realistic.