ISO 42001 Does Not Guarantee AI Regulatory Compliance, But It Is the Right Place to Start

As AI regulations are becoming laws in different countries, many organisations are asking an important question: Does ISO/IEC 42001 certification make an organisation compliant with AI regulations?

The simple answer is No. ISO 42001 certification does not automatically make an organisation legally compliant with AI regulations. However, it provides a strong foundation for managing AI responsibly and preparing for regulatory requirements.

Let's understand the difference and why this standard is still important.

1. What Do AI Regulations Require?

AI regulations focus on how AI systems are used and the risks they may create.

Depending on the level of risk, organisations may need to follow different requirements, such as:

• Avoiding prohibited or harmful AI practices.

• Maintaining proper records and documentation.

• Ensuring human supervision of high-risk AI systems.

• Protecting data and maintaining its quality.

• Ensuring AI systems are accurate, reliable and secure.

• Providing transparency about how AI systems are being used.

These requirements may differ depending on whether an organisation develops, uses, distributes or imports an AI system.

2. What Does ISO 42001 Require?

ISO/IEC 42001 is an international standard that helps organisations establish and manage an Artificial Intelligence Management System (AIMS).

It provides a structured approach to managing AI responsibly throughout its lifecycle.

The standard helps organisations to:

• Identify how AI is being used within the organisation.

• Understand the risks and potential impact of AI systems.

• Establish AI policies, objectives and responsibilities.

• Implement appropriate controls to manage AI-related risks.

• Maintain documentation and records.

• Monitor AI systems and improve their performance.

• Consider the impact of AI on individuals, society and business operations.

In simple terms, AI regulations focus on legal obligations, while ISO 42001 focuses on building a management system to govern AI responsibly.

3. Why Is ISO 42001 Still Important?

Although ISO 42001 does not guarantee regulatory compliance, it helps organisations build many of the processes needed to meet regulatory expectations.

For example:

• Documentation: Regulations may require organisations to maintain AI system records. ISO 42001 helps establish a process for maintaining this documentation.

• Human Oversight: Regulations may require human supervision of certain AI systems. The standard helps organisations define responsibilities and establish appropriate controls.

• Risk Management: Regulations may require organisations to identify and manage AI-related risks. ISO 42001 provides a structured risk management approach.

• AI Governance: Organisations need to understand their responsibilities when developing or using AI. The standard helps establish clear roles, policies and accountability.

• Continuous Improvement: Regular monitoring and review help organisations identify gaps and improve their AI management practices.

Therefore, an organisation with an effective ISO 42001 management system may be better prepared to address AI regulatory requirements than an organisation without a structured AI governance framework.

4. What Should Organisations Tell Their Customers?

Organisations should communicate the purpose of ISO 42001 certification clearly and honestly.

Certification does not mean that every AI system used by the organisation automatically meets all applicable legal requirements.

Instead, it demonstrates that the organisation has established an AI management system based on internationally recognised requirements for responsible AI management.

The organisation must still evaluate its legal obligations separately, depending on the AI systems it develops or uses and the regulations applicable to its business.

This approach builds trust and avoids making claims that cannot be supported.

5. What Should Organisations Do Now?

Whether or not specific AI regulations apply to your organisation today, taking the following steps can help you prepare for the future.

1. Identify Your AI Systems 

Prepare a list of all AI systems being developed, purchased or used within your organisation. You cannot effectively manage or assess risks without knowing where AI is being used.

2. Understand Your Responsibilities

Identify whether your organisation develops AI systems, uses third-party AI solutions or performs both activities. Your responsibilities may differ depending on your role.

3. Assess AI-Related Risks

Evaluate the potential impact of AI systems on your business, customers, employees and other stakeholders.

4. Understand Applicable Regulations

Review the AI laws and regulatory requirements applicable to the countries where you operate. Consult legal experts to understand specific obligations and implementation timelines.

5. Establish an AI Management System

Consider implementing ISO/IEC 42001 to create a structured approach to AI governance, risk management, accountability and continuous improvement.

Conclusion

AI regulations are changing how organisations develop, manage and use artificial intelligence. Simply using AI responsibly is no longer enough; organisations must also demonstrate that appropriate processes and controls are in place.

ISO/IEC 42001 provides a practical starting point by helping organisations establish a structured AI management system.

Remember: ISO 42001 certification does not replace legal compliance. It helps organisations build the foundation to manage AI responsibly and prepare for evolving regulatory expectations.