.jpeg)
ISO 42001 is the international standard for organizations serious about responsible AI use and development. It is a management system standard, similar to ISO 27001 for information security, for example, but specifically focused on AI.
The standard provides guidance on how to develop, implement and manage AI systems, considering issues such as:
- security;
- ethics;
- transparency; and
- privacy.
In other words, you lay a solid foundation for reliable AI. After a successful audit, certification offers numerous benefits, including:
- Implementation of AI with evidence of responsibility and accountability.
- Consideration of safety, transparency, fairness and quality over the life cycle of AI.
- Clear objectives and strong governance with a balance between innovation and management.
- Ensure responsible use of AI, with continuous learning.
- Integration with other management standards for a similar approach.
Why is this relevant to you?
AI offers enormous opportunities, but it also carries risks. Think biased algorithms, lack of control or uncertainty about how decisions are made. ISO 42001 helps you identify and manage these risks.
An important part of the standard is the AI System Impact Assessment (AISA). With it, you visualize the effects of your AI applications on individuals and groups. It's a bit like the Data Protection Impact Assessment (DPIA) from the AVG, but specifically for AI. That way you can say with confidence, "Our AI system does what it's supposed to do and we've thought through the impacts."
What's in ISO 42001?
A few highlights:
- 38 management measures divided into 9 domains.
- Clear overlap with the Harmonized Structure of ISO 27001 (useful if you already have it).
- Focus on integrated risk management, from technical measures to governance and policy.
The 9 domains of the Annex A
As just mentioned, there are 38 management measures that are part of ISO 42001. You can divide these into 9 different domains:
- A.2 - Policies related to AI
- A.3 - Internal organization
- A.4 - Resources for AI systems
- A.5 - Impact assessment of AI systems
- A.6 - Life cycle of AI systems
- A.7 - Data for AI systems
- A.8 - Information for parties interested in AI systems
- A.9 - Use of AI systems
Five examples of management measures
1. AI Policy (A.2.2) - Direction and responsibility.
Any organization using or developing AI should have a formal AI policy. This policy defines why and how the organization deploys AI: what the goals are, what values and principles (such as fairness, transparency, privacy) apply, and who is responsible for what.
2. AI System Impact Assessment (A.5.2) - Understand the impacts.
This is a mandatory process that must be implemented in order to pre-assess what impact an AI system may have on people, groups or society. Consider risks around privacy, discrimination or abuse.
3. Quality of data (A.7.4) - No good AI without good data
AI systems are only as good as the data with which they are trained. This management measure requires that organizations establish and monitor criteria for data quality - such as completeness, accuracy, representativeness and timeliness.
4. Transparency and explainability (A.8.2 / A.8.5) - Make AI understandable
Organizations must ensure that AI systems are understandable and explainable to users, customers and regulators. They must be able to explain how decisions are made and what the limitations are.
5. Human supervision and intervention (part of A.6.2.6 / A.9.2) - Human in the loop
AI may support decisions, but humans must be able to intervene when the system makes mistakes or exhibits undesirable behavior.
Accreditation ISO 42001
There are now official accreditation rules for certifying bodies. This means you can get your ISO 42001 certification quickly.
Learning and doing together
At Fendix, we recently teamed up with Brush AI and Tidal Control to look at how to tackle an ISO 42001 implementation. That was both instructive and inspiring. Read here how we approached it: Fendix x Brush AI x Tidal Control: together towards a successful ISO 42001 implementation.
In short: ISO 42001 helps you deploy AI responsibly. It creates trust - with your customers, your employees and society. And that trust is perhaps the most important condition for really taking advantage of AI's opportunities.
