On July 16, 2024, ORO was recognized as the first company in the world to earn an accredited ISO 42001 certification for an Artificial Intelligence Management System (AIMS) scope. According to the International Organization for Standardization, ISO 42001 “is the world’s first AI management system standard, providing valuable guidance for this rapidly changing field of technology. It addresses the unique challenges AI poses, such as ethical considerations, transparency, and continuous learning. For organizations, it sets out a structured way to manage risks and opportunities associated with AI, balancing innovation with governance.” But what does this mean in practice? And what does this mean for procurement organizations?
In this blog post, we’ll explore the new standard, explain the certification process, and describe the practical implications for procurement departments as they seek to make informed decisions about AI investments, both for themselves and as stewards of responsible AI for the rest of the organization.
ISO 42001 “is an international standard that specifies requirement for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations.” It was released in December 2023.
What is an AIMS? Again, according to ISO, an AIMS is “a set of interrelated or interacting elements of an organization intended to establish policies and objectives, as well as processes to achieve those objectives, in relation to the responsible development, provision or use of AI systems.” In other words, an AIMS is not a piece of technology. It is a governance framework for ensuring responsible oversight of all AI technologies produced, developed, provided, or used by a given organization.
Most large enterprises already have an AIMS or are in the process of establishing one. But in the absence of a recognized global standard for what an ideal framework looks like, these systems can differ significantly from organization to organization. They may also be incomplete or lacking in critical areas. For instance, an organization’s AIMS may address issues of data governance, while neglecting other important aspects like ethical considerations. As an international standard, ISO 42001 serves as both (1) a rubric for creating and maintaining an AIMS, making it easier for more organizations to adopt a more complete and systematic approach to AI governance, and (2) a benchmark against which any AIMS might be evaluated.
Companies with an accredited ISO 42001 certification have to be rigorously evaluated by an impartial management systems certification body which, in turn, needs to be accredited by an accreditation body. In order to earn the very first accredited ISO 42001 certification, ORO completed an internal audit by Geels Norton, and an external audit by Mastermind observed by the International Accreditation Service (IAS).
The ISO 42001 standard covers several key elements that are essential to the responsible management of AI systems:
Does the organization have AI policies and practices in place to ensure both continuous improvement and alignment with other relevant ISO standards?
In terms of technical specifications, ISO 42001 provides clear requirements to ensure that AI management systems are aligned to organizational goals and standards, ensuring respect for privacy, security, and ethical considerations.
Does the organization have a systematic approach to identifying and mitigating risks throughout the AI lifecycle? How does the organization evaluate the consequences of AI on individuals and societies?
ISO 42001 requires organizations to conduct comprehensive risk and impact assessments to identify potential consequences for users, communities, and societies in general. More than a mere assessment, the standard requires organizations to develop and implement strategies to mitigate identified risks and minimize potentially negative implications of its AI systems.
Do policies, practices, and tools comply with privacy laws? How does the organization safeguard AI systems against potential threats?
ISO 42001 strongly emphasizes the need for AI systems to comply with data protection laws and regulations, including the implementation of security measures to protect systems from unauthorized access, data breaches, and other cyber-security threats. Of particular note is a focus on maintaining transparency in AI decision-making to promote trust and accountability.
Procurement departments benefit from this new standard in a number of ways:
Taken together, these advantages translate into higher ROI through cost avoidance and risk elimination, increased efficiency by minimizing effort on the part of organizational resources, system stability and coherence, and continuous improvement guided by a clear vision for responsible AI.
Overall, the ISO 42001 standard and certification can reassure procurement departments of the quality and reliability of their AI systems, enhancing trust, compliance, and operational efficiency. The standard sets the bar for evaluating the quality of AI governance within organizations and should be used to evaluate vendors as well as internal AI governance initiatives.
The current AI boom presents both promise and risk, and we are pleased that ISO has released this important international standard. ORO Labs is proud to have earned the world’s first accredited ISO 42001 certification and lead the way in demonstrating the responsible development and use of AI systems in the service of humanizing the procurement experience for all.