ISO/IEC 42001:2023 is the very first version of this standard, addressing an immediate and growing need.
It is a joint standard, developed collaboratively by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). This standard was created to address the immediate and growing need for a structured approach to managing AI systems within organisations.
The standard provides a framework for ethical AI management, with a focus on responsible deployment and risk management. It can be implemented across various sectors and industries, supporting organisations in integrating AI technologies while maintaining ethical standards and building stakeholder trust.
As a foundational standard for AI management, ISO 42001 is designed to align with existing management systems.
ISO/IEC 42001 guides you in setting up an effective Artificial Intelligence Management System (AIMS) for your organisation.
The standard focuses on several key areas to help you manage AI systems responsibly:
These requirements help you build a framework for ethical, secure, and transparent deployment of AI technologies.
ISO/IEC 42001 certification demonstrates that your organisation’s AIMS meets the requirements of the ISO/IEC 42001 standard. It assures customers, partners, and regulators that you manage AI technologies responsibly.
Certification focuses on your AIMS. An independent body evaluates your AI-related processes, policies, and procedures. If they meet ISO/IEC 42001 requirements, your organisation will achieve certification, which must be renewed periodically to maintain compliance.
Certification helps to build trust with stakeholders, supports businesses in meeting regulatory requirements, and helps them to gain a competitive edge by showing their commitment to ethical AI management.
To achieve certification, follow these steps:
Thorough preparation and resources make achieving certification beneficial for your organisation.
Both ISO 27001 and ISO 42001 support risk management and organisational governance, however they focus on entirely different areas – information security (ISO/IEC 27001:2022) vs. AI management (ISO/IEC 42001:2023).
Here’s a brief outline of the two standards and how they differ:
ISO 27001
ISO 42001
ISO 42001 helps organisations manage AI systems responsibly. It provides guidelines to handle AI-related risks, improve transparency, and build trust with stakeholders. The standard integrates AI governance with existing management processes, to help businesses that use AI to comply with ethical guidelines and legal requirements.
Here is just one example of where ISO 42001 can be used – a financial services company might use ISO 42001 to oversee its AI credit scoring tools. By implementing the standard, the company is supported in creating fair and transparent AI systems, reducing the risk of biases in customer evaluations. Regular checks of AI systems can help identify and reduce risks, helping businesses comply with the law and maintain customer trust. This can improve AI reliability and demonstrate a commitment to ethical AI use.
In clause 4.3 of the ISO/IEC 42001 standard document, there is a specific mention of the requirement for organisations to establish an AI policy. This is crucial for providing direction and support while implementing a ISO 42001-compliant Artificial Intelligence Management System.
The AI policy should:
Creating a thorough AI policy allows organisations to demonstrate their leadership’s dedication, incorporate AI governance into their activities, and encourage responsible use of AI across the business.
