In the previous post, ISO standards relating to the governance, management and quality of AI (I), we presented the standards that address topics relating to AI governance. On this occasion, we will look at the standards [1] relating to organisational management of AI, which should not be confused with AI governance.
AI Management Systems
ISO/IEC 42001 Information technology — Artificial intelligence — Management system
This international standard specifies the requirements and provides guidance for establishing, implementing, maintaining and continuously improving an Artificial Intelligence Management System (AIMS) within the context of an organisation. It is designed for organisations that develop, provide or use products or services whose operation is based on AI systems. Its main objective is to help organisations manage their responsibilities in a systematic manner, ensuring reliability, transparency and accountability, whilst balancing innovation with risk management.
The standard strictly requires two fundamental analytical processes during its operational phase:
- AI risk assessment: Identifying and analysing the specific risks associated with the reliability, security, biases and technical failures of the organisation’s AI systems.
- AI system impact assessment: To explicitly assess how AI systems affect individuals, social groups and society (ethical, privacy and fundamental rights impacts).
The standard includes Annex A, which sets out a series of control objectives and specific controls that the organisation must address through a Statement of Applicability (SoA).
The primary purpose of this standard is to serve as a practical implementation guide for organisations wishing to adopt, develop or certify their AIMS based on the mandatory requirements of the parent standard, ISO/IEC 42001.
Unlike ISO/IEC 42001 (which sets out the requirements that must be met), ISO/IEC 42003 focuses on the ‘how’, and is structured around the following key areas:
- Professional Competencies: These specify the knowledge, skills and competencies required of professionals responsible for designing, auditing and maintaining the AI Management System within the organisation.
- Operationalising Principles: Translates abstract concepts of AI governance (such as transparency, fairness, explainability and accountability) into management processes, organisational roles and measurable metrics.
- Risk-Based Approach: Provides step-by-step guidelines for identifying, assessing and mitigating specific AI risks (such as algorithmic bias, data security and ethical impacts) throughout the entire system’s life cycle.
- Integration and Continuous Improvement: Explains how to align AI controls with other existing management systems (such as ISO 9001 for quality or ISO/IEC 27001 for information security), whilst promoting internal audits and continuous improvement.
Unlike other standards in the series that apply to organisations using or developing AI, ISO/IEC 42006 is aimed exclusively at conformity assessment certification bodies and accreditation bodies.
Its aim is to ensure that any audit carried out against the AI management standard (ISO/IEC 42001) is consistent, reliable, impartial and technically sound worldwide.
The main purpose of this standard is to provide a high-level framework and technical guidelines to enable scheme owners (such as regulators, industry associations or certification bodies) to design, develop and operate conformity assessment schemes specific to SIA.
Unlike ISO/IEC 42006 (which assesses organisational management systems), ISO/IEC 42007 focuses on how to structure programmes that certify or assess the AI product or system itself.
ISO/IEC 42005 Information technology — Artificial intelligence (AI) — AI system impact assessment
This standard is designed to help organisations identify, assess and mitigate the potential impacts (both positive and negative) that the deployment and use of an AI system may have on individuals, social groups, society as a whole and the environment. It aims to serve as a tool to ensure that AI is ethical, trustworthy and accountable.
ISO/IEC 42005 serves as a global technical framework that helps organisations comply with strict legislation, such as the high-level risk assessment requirements set out by the European Union’s AI Act.
[1] The summaries of the content presented in this post have been provided directly by GEMINI and reviewed by I2SC.