How to Prepare for ISO 42001 Certification

Since the release of ISO 42001 in late December 2023, it’s been a year of discovery and education regarding this new flagship artificial intelligence (AI) standard in terms of determining its applicability, use case(s), and benefits to organizations. For those who have since determined ISO 42001 is the right framework for them, the next step has been to prepare for certification, and that involves more than a few steps.

As the first ISO 42001 ANAB-accredited Certification Body, we’re now more than ready to help organizations obtain certification, and we’re going to offer some expert advice on how your organization can prep for such too.

In this blog post, we’ll detail five steps you can take to prepare for ISO 42001 certification. With this insight in mind, you can put your organization in the best position to succeed in this compliance endeavor.

5 Steps to Help You Get Ready for ISO 42001

Anyone who has pursued an ISO certification before will know that adopting a management system standard can be a more intense task than aligning with other frameworks.

To help you get started, we’ve put together the following 5 areas of focus for organizations looking to implement an AI management system (AIMS) and meet all the requirements for ISO 42001 certification.

1. Define Your AI Strategy

While this may seem like an obvious starting point, ensuring that your organization has a defined AI strategy that is followed and communicated throughout the organization is crucial.

In determining yours, ask questions like:

• Are we outsourcing components for our AI systems or are we building our large language models (LLMs) completely in-house?
• What are the intended uses of our AI systems (geographies / industries served, etc.)?
• What types of data will our AI systems process, store, transmit, etc.?
• Where will we source our model training data, and what are our data quality characteristics?

Your answers will provide the cornerstones for both your AI strategy and—together with your organization’s role in the delivery of the AI system(s)—will help also drive the extent of the applicability of the ISO 42001 standard. For detailed definitions of the various AIMS roles, you can reference ISO/IEC 22989.

(Your answers will also inform how you perform the requisite effective risk management practices—more on that in a moment.)

2. Understand Your Resource Requirements

Once you’ve got a handle on what you need to create and implement based on your strategy and the applicable ISO 42001 requirements, you need to decide: Does your organization intend to build your AIMS using in-house expertise or will you need a third-party consultant to help with that prior to engaging a certification body?

Before you decide on the former—building an AIMS in-house—consider whether you have the available resources to keep things on the right track. That includes whether you have the in-house expertise and independence / objectivity to perform an effective internal audit—an ISO 42001 requirement. If not, perhaps that should be outsourced (as well).

Furthermore, if you do have the resources to make all your implementations in-house, you may still want to consider having a readiness assessment performed ahead of your certification audit so that you can go into the latter more confident that you won’t encounter any surprises.

3. Educate Your Team

If you instead decide to outsource aspects of your AIMS to a consultant, it’s important to note that your organization will still ultimately own and be accountable for the effective performance of their AIMS in accordance with the ISO 42001 requirements—not the consultant.

That’s why, no matter how you implement your AIMS, it’s critical that you clearly instruct the team involved in the operation of the AI systems regarding:

• Their role(s);
• Potential risks of the AI system; and
• Policies and procedures that govern the acceptable use and development of AI systems.

(For organizations implementing this framework for the first time, Annex B of ISO 42001 contains the implementation guidance for each of the 38 controls within Annex A and can serve as a very helpful reference when spreading awareness among your team.)

4. Assess Your Risk

Training your team on their responsibilities in operating the AIMS is important, but so is your risk assessment process. Management system standards—like ISO 42001—revolve around risk management, and a critical component of yours within the context of this framework is the AI system impact assessment.

Meant to help you determine the potential / reasonably foreseeable impact of your AI systems on individuals, groups of individuals, and / or societies, effective AI system impact assessments must analyze areas that include, but are not limited, to, the following:

• AI system features, purpose, and uses (intended / unintended)
• Data information and quality (dataset characteristics, sourcing, etc.)
• Algorithms and model information (foreseeable risks / vulnerabilities, metrics used to validate system performance, model training criteria, etc.)
• Deployment environment (geographies served, pre-deployment checks like red teaming to identify system vulnerabilities, deployment constraints, etc.)
• Relevant interested parties (if your organization deploys a model, who is the AI system developer, and what is the shared responsibility breakdown?)
• Actual and potential benefits and harms (in areas like security, privacy, safety, environmental, etc.)
• AI system failures and misuse and abuse

For more details, ISO 42005 provides helpful guidance and even a template for organizations performing AI system impact assessments, whose importance can’t be overstated—your results will play a crucial role in the responsible use and development of AI systems, as well as the implementation of proper safeguards and controls.

5. Implement and Document Controls & Processes

Once you’ve completed the AI risk assessment process—impact assessment included—you can begin implementing controls that will help you mitigate the risks you identified.

In doing so, ISO 42001’s Annex A makes for a good starting point (those controls would need to be incorporated into your statement of applicability). That being said, you’re also free to utilize other sources of controls outside of—or in addition to—Annex A as well if those are better suited to your organization’s context.

That being said, you should take care to document all your implemented controls and AIMS processes, procedures, and methodologies—doing so is critical for the success of your ISO 42001 certification since all of these items will be verified by the third-party Certification Body that will assess compliance prior to issuing your certification (or not).

Moving Forward with ISO 42001 Certification

Now that organizations are realizing the very open void that ISO 42001 has filled as it relates to their ability to showcase their responsible and trustworthy use of AI—especially in the wake of several other emerging regulations—knowing where to begin your compliance journey will be paramount to ensuring you focus on the correct areas.

These five preliminary steps we’ve just provided will help you get started with meeting the ISO 42001 requirements, but as you progress through your certification journey, feel free to contact us with any other questions that may arise.