Integrating ISO 42001 AI risk management into existing compliance programs

Artificial intelligence has moved beyond being an experiment and is now being used every day to make high-risk business decisions related to hiring, lending, access to health care, and interaction with customers via automation. Most of these decisions introduce ethical, legal and operational risks that were not anticipated by traditional governance models. With the increase in the use of artificial intelligence the organisation needs to control risk without impeding the speed of innovation or putting additional burdens on compliance. This blog will describe how to integrate ISO 42001 AI risk management into your existing compliance program. It will outline the alignment of ISO 27001, privacy frameworks, enterprise risk frameworks and provide practical implementation steps.

Understanding ISO 42001 and why it matters for AI governance

ISO 42001 will provide an international standard for managing artificial Intelligence (AI) risks in any organisations. This newly developed standard provides a structured approach to identifying, assessing, and mitigating AI risks based upon the governance, accountability, and operational controls. While many technical standards exist, the emphasis of ISO 42001 is not on technical criteria but rather on the sustainability of organisations by managing bias, transparency, security and regulatory risks throughout the AI lifecycle. ISO 42001 is designed to provide systematic processes by which organisations can manage bias, transparency, security and regulatory exposure. It is not intended to be a replacement for existing frameworks but rather will serve as a complement to existing frameworks.

Why integrating ISO 42001 is better than building a new compliance program?

Numerous organisations already have existing ISO 27001, privacy, and enterprise risk management initiatives in place. The creation of an additional governance structure specifically for AI will create additional costs, complexity and operational friction. ISO 42001 has been designed to provide seamless integration into an organisation’s ISO 27001-based management system. This will reduce duplication and improve visibility of risks specific to AI. Through integration, AI risks will be managed with the same level of discipline as are security risks, resulting in a significant increase in an organisation’s readiness for audit and confidence to comply with regulations.

Aligning ISO 42001 with ISO 27001 information security management system

ISO 27001 is primarily about protecting your information assets using formalized security controls; ISO 42001, on the other hand, extends this protection to AI-based decision-making and automated processes. Both standards share similar high-level structure for governance (risk assessment and continuous improvement) that provide a foundation for integrating the two standards into one overall AI governance framework. ISO 27001 already defines many security controls inherent in protecting data that apply to AI models as well. AI Models have unique risks like the inappropriate use of an AI model and the manipulation of the output of an AI model and therefore require additional controls over them. Integration of both standards will result in a reliable and effective AI Governance Framework.

Key alignment areas between ISO 42001 and ISO 27001

• Risk management processes can be expanded to include risks associated with AI models.
• AI models and their associated training datasets can be included in existing inventory of assets.
•  Incident response plans can include AI-related failures and potential misuse scenarios.
• Behaviour and access patterns for AI systems can be tracked by security monitoring tools.

Integrating ISO 42001 with privacy and data protection programs

Laws governing personal data (i.e., Privacy) dictate how the information can be collected, processed, and stored.

AI systems greatly increase the risk of violating people’s right to privacy due to profiling, inference, and automated decision-making. ISO 42001 supports privacy principles by ensuring that AI data is responsibly used. Privacy Impact Assessments can also cover risks related to the use of AI models. The principles of consent, purpose limitation, and data minimization must continue to be key controls. Integrating AI into the remaining areas of the Privacy Act will also increase compliance with privacy laws around the world.

Aligning ISO 42001 with enterprise risk management frameworks

Enterprise risk programs provide a holistic approach to managing all financial, operational, and strategic risks. As AI technology emerges, enterprise risk models will likely not identify potential risks associated with AI. ISO 42001 provides a framework for classifying AI-based risks along with other organizational risks. Risk registers should identify specific types of AI-based risks such as bias, explainability, and accountability. Governance and oversight by boards of directors ensures that AI risks receive adequate attention. These elements help create a framework for integrating AI risk control into decision-making for the business.

Mapping ISO 42001 controls to existing compliance frameworks

Mapping and eliminating redundancies can greatly reduce the complexity of compliance implementation. First, organisations need to identify the areas where controls from multiple compliance frameworks overlap. All of the governance, documentation, and review processes that are created can be reused collectively.

Mapping areas of overlap across issues:

• Governance roles in ISO 42001 framework correspond to existing compliance governance leadership positions.
• Risk assessments in both ISO 27001 and enterprise risk evaluations follow the same cyclical approach.
• Monitoring requirements align with ongoing security operations and audit programs.
• Documentation corresponds to existing policy and evidence repositories.

Mapping creates a level of consistency and generates minimal duplication of effort when working to meet multiple compliance requirements.

A phased ISO 42001 integration roadmap to minimize overhead

Phase One: Review present compliances & governance frameworks

• Form a new committee for AI Governance or include AI governance initiatives into existing committees
• Examine what is presently in place to govern/compliance and is in place already addressing an AI risk control.
• Subsequently, finish an ISO 42001 Gap Analysis.
• Focus on the high-priority AI uses/cases first.

Phase Two: Revise policies and procedures

• Include AI governance/accountability in governance policies.
• Align the security, privacy, and AI assessment risk methodologies.
• Identify clearly Ai roles and responsibilities and the escalation process.
• Assure that documentation supports integrated governance.

Phase Three: Operational implementation

• Integrate AI risk into all subsequent development or deployment workflows.
• Educate groups concerning AI risks and governance.
• Incorporate tools to monitor AI usage and performance.
• Utilize AI risk scenarios to test incident response plans.

Phase Four: Continuous improvement & monitoring

• Frequent review of AI risk metrics and controls.
• Stay abreast of changing regulations related to AI governance.
• Continuous improvement of the AI governance framework as all audits of AI controls and risks are completed.
• Conduct management reviews at defined intervals to evaluate AI governance performance.

Tooling and automation to support ISO 42001 integration

Using a manual process to manage your Governance Framework does not scale with your increasingly complex Artificial Intelligence Systems. Automation assists you with the ability to monitor risks, collect evidence, and report results. Utilizing Integrated Governance, Risk & Compliance Tools (GRC tools) like  Secusy makes managing compliance much easier. AI monitoring tools can detect model drift and other abnormal behaviour. Dashboards give leadership teams visibility into the risk posed by AI systems.

Governance roles and accountability for AI risk management

To effectively govern artificial intelligence management system there needs to be a clear ownership role with staff from the legal, security, data and business teams having a ‘joined up’ role that ensures accountability so that AI risk can be managed proactively. In addition, human oversight will always remain important for all high-risk AI decision-making. Ensuring there are escalation paths will help prevent and mitigate the occurrence of unresolved incidents with AI.

Regulatory expectations driving ISO 42001 adoption

Effective AI Governance requires clear ownership, with responsibilities distributed across legal, security, data and business functions. Knowing who is accountable ensures that AI related risks will be addressed in a timely way. Human oversight is critical for decisions involving high-risk AI systems. Well-defined escalation paths help to enable quick resolution of all unresolved incidents involving AI systems.

Conclusion

Improper or traditional governance models will hamper AI risk management’ s effectiveness. By integrating existing compliance programs with ISO 42001 we are able to provide clear and efficient AI risk controls, while reducing the overhead associated with operational processes involving AI risk controls. This integration in turn will increase transparency and provide the basis for the continued confidence of regulators and stakeholders with regard to AI risk controls. In addition, strong AI governance enables the reduction in value at risk and continued growth of innovation through its enhancement of trust. ValueMentor assists organisations to design and implement integrated AI governance frameworks. 

To learn more about how to easily integrate your ISO 42001 compliance program visit Valuementor.

FAQS