ISO/IEC 42001: Managing AI Responsibly with an AI Management System
As more businesses build or buy artificial intelligence, customers and regulators ask how that AI is governed. ISO/IEC 42001, published in December 2023, is the first international standard for an Artificial Intelligence Management System (AIMS). It gives organizations a structured way to develop, provide or use AI responsibly.
Who it is for
The standard applies to any organization that develops, provides or uses AI-based products or services, in any industry and of any size. That includes a software company with its own models and a company that only uses AI tools from a supplier.
What an AI management system covers
- Context and scope: where AI is used, who is affected and what the organization must respect.
- Leadership and policy: an AI policy approved by management, with clear roles and accountability.
- Risk and impact assessment: identifying risks to the organization and the effects of AI on individuals and society.
- Lifecycle controls: design, development, testing, deployment, monitoring and retirement of AI systems.
- Data management: the quality and source of data used to train and run AI.
- Transparency and oversight: information for users and appropriate human oversight.
- Third parties: managing suppliers and partners that provide AI components.
- Improvement: monitoring, internal audits and management reviews, as in other ISO management systems.
How it fits with other standards
ISO/IEC 42001 follows the same management system structure as ISO/IEC 27001. If you already run an information security management system, many parts, such as internal audit, document control and management review, can be shared. Privacy and security controls remain important, because AI systems depend on data.
Steps to get started
- Make a list of the AI systems you build, buy or use.
- Set an AI policy and name who is responsible for it.
- Assess the risks and impacts of each system.
- Put controls in place for data, testing, monitoring and human oversight.
- Train the people who work with AI.
- Run an internal audit, then consider an external audit by an accredited certification body.
Final thoughts
Good AI governance builds trust with customers and gives teams a clear way to make decisions. ISO/IEC 42001 provides that structure, and it can be added to the management systems you already have.