ISO/EIC 42001

What is ISO/EIC 42001

Introduced in 2023, ISO/EIC 42001 (ISO 42001)is an international standard that provides guidelines for establishing, maintaining, and improving an organization's Artificial Intelligence Management System (AIMS).  It was designed to meet the needs of organizations seeking to achieve compliance with an international management system standard focused on AI governance.

The goal of ISO 42001 is to provide a comprehensive framework that can be used by organizations to develop and manage their AIMS in a responsible and ethical way.  Using this framework organizations can deliver transparency and accountability while mitigating potential AI related risks throughout the AI system lifecycle.  

Like other ISO standards, ISO 42001 explicitly uses the "Plan-Do-Check-Act" (PDCA) approach, emphasizing a continuous improvement cycle for managing AI systems within an organization.

What’s In the ISO 42001?

The standard addresses the top seven issues that can impact the successful implementation of an AIMS.

Top Seven Issues

1. The organizational context in which the AIMS will operate.
2. The role of leadership in helping to drive adoption of the AIMS.
3. The importance of effective planning to ensure the right AIMS gets built.
4. Providing appropriate support resources to teams participating in the AIMS.
5. Operating AI systems in accordance with AIMS requirements.
6. Conducting frequent and ongoing evaluation of the AIMS performance against objectives.
7. Continuously seeking to improve the overall effectiveness of the AIMS.

Organizational Context

A first step in creating an AIMS is understanding the organization in which the AIMS will operate.

Achieving compliance with this requirement requires:

• Conducting impact assessments to identify the internal and external forces and issues that may potentially impact the AIMS.
• Understanding stakeholder needs and expectations.
• Clearly defining the scope and the boundaries of the AIMS.

Leadership Engagement

For an AIMS initiative to succeed, senior leaders of the organization must actively champion the effort.  

Leaders of the organization are accountable for making sure the following actions are executed.

• An AI policy is created that is actively communicated to the organization.
• The AIMS is integrated into all the appropriate organizational processes.
• Roles, responsibilities, and accountability are clearly defined and communicated.
• Resources are made available as needed to support the AIMS.

Effective Planning

The Planning requirement associated with the standard details the processes needed to identify the risks and opportunities related to the AIMS.  

Necessary actions associated with this requirement include:

• Identifying and addressing risks and opportunities to ensure the AIMS achieves its objectives.
• Putting in place measurable objectives along with the plans to achieve those objectives. Plans must include timelines, responsibilities, and evaluation methods.
• Ensuring that changes to the AIMS are carefully planned so that the integrity and effectiveness of the AIMS is maintained.

Support Resources

The Support requirement focuses on ensuring that the organization has everything needed to effectively implement, maintain, and improve the AIMS.  

Demonstrating compliance with this requirement requires that organizations:

• Provide necessary resources, including training personnel, and promote awareness of AI policies and responsibilities.
• Establish effective internal and external communication processes to support the AIMS.
• Document AIMS related information, such as policies and ensure that these documents are appropriately maintained, controlled, and protected.

Operations

Operational planning and control are the foundation of an AIMS, ensuring that AI processes are aligned with organizational goals.  

To achieve compliance with the Operational requirements of the standard organizations need to address the following:

• Plan, implement, and control processes focused on the responsible development and deployment of AI systems.
• Ensure data quality, monitor system performance, and maintain AI systems, addressing issues like bias and transparency.
• As part of a robust risk management program, mitigate cyber threats and other security risks that could impact the performance, safety, or ethical compliance of AI systems.
• Put in place processes for updates and improvements that ensure ongoing compliance and system effectiveness.

Performance Evaluation

The performance requirement mandates organizations engage in a systematic approach to monitoring, measurement, analysis, and evaluation of their AI systems’ performance.  

Key requirements that must be satisfied related to performance evaluation include:

• Monitoring, measuring, analyzing, and evaluating the performance and effectiveness of the AIMS.
• Conducting regular internal audits and management reviews to assess compliance, identify areas for improvement, and ensure the AIMS remains suitable and effective.
• Using performance data, audit results, and stakeholder feedback to drive continuous learning.

Continuous Improvement

Continuous improvement requires that organizations regularly review learnings and make adjustments to processes, policies, and objectives to address identified gaps or opportunities for enhancement.

Satisfying requirements in this area requires that organizations periodically:

• Identify opportunities for improvement to enhance the effectiveness of the AIMS.

• Address nonconformities through corrective actions, including root cause analysis and prevention of recurrence.
• Actively work to align the AIMS with stakeholder concerns or ethical considerations.

Where to Start

When considering how to get started with ISO 42001 consider the following strategic actions.

1. Compare current AI practices against ISO 42001 requirements to better understand where gaps exist that will need to be addressed.
2. Start the process of designing or redesigning an AIMS that achieves the objectives of ISO 42001.
3. Conduct risk assessments of your AI uses and then take a proactive and comprehensive approach focused on mitigating AI risks before they become significant issues.
4. Ensure that your AI policies effectively address ethical considerations as well as data protection and privacy concerns.
5. Document processes and prepare for an external audit as part of the process to achieve ISO 42001 certification.

‍