StackAware Pioneers Responsible AI by Becoming ISO 42001 Certified with Schellman

Achieving ISO 42001 Certification Success with Schellman 

With the ISO 42001 standards being so brand new in the market, StackAware had a bit of a natural learning curve at the outset of the audit. To tackle this, they invested in a gap assessment--something Haydock highly recommends, as it helps when becoming familiar with the framework’s requirements. “I would recommend doing that gap assessment first because that highlighted a lot of things to me that were important for the audit.”  

For instance, in their work, StackAware tries to make everything machine readable and reusable using structured databases and functions to reduce variability and manual effort.  “The issue is that it's very challenging to present that to someone who isn't intimately involved in the inner workings of our system. So, making sure that there was an easy way to create human readable documents from our underlying data was important.”  

That need to export this information in a more presentable way was discovered during StackAware’s readiness review and in response, Schellman worked with StackAware to get to a point where all their policies and procedures became trackable in a structured database. Now, an auditor can more easily interrogate the information and make sure the necessary requirements are being met and simultaneously, StackAware knows they are keeping a single source of truth without risk of duplicative entries.  

When the more in-depth certification audit commenced, Schellman adopted a customized approach to work flexibly with StackAware, including meeting their business standards when dealing with sensitive and confidential information. Haydock explains that “building the AI management system documentation with the view for external review” was an important step, and that Schellman helped in establishing “a structured set of Google Drive folders that [StackAware] could control the permissions to.” In the end, Schellman had “access to the confidential information for StackAware and at the same time, I could have something that's public facing that didn't have that sensitive data.”  

Finding this balance was a crucial component of their effective partnership and successful audit. “[Haydock] is a firm believer in transparency” confirms Zuby Alikhan, Senior Associate at Schellman who lead the ISO 42001 certification review for StackAware.  He explains access to this publicly available information “made it relatively easy to ask the questions we need to and even ask more in detail to understand [StackAware’s] perspective on how [they] addressed AI risks and met their overall objectives.”  

Alikhan stresses the importance of adopting this kind of cohesive collaboration when tackling ISO 42001 certification, “it was a mutual understanding the standard is new for both of us, and the belief of transparency and openness made the auditing process smooth.” Haydock agrees that this synergy led to a powerful partnership, “we worked together to come up with a flexible way to get the audit done while at the same time meeting our business objectives.”  

StackAware’s extensive preparation and willingness to be transparent were invaluable, and Schellman’s proactive communication also contributed to their effective partnership. “[Haydock] is a firm believer in keeping meetings as efficient and concise as possible” explains Alikhan, so Schellman made sure to always come prepared. He shares Haydock “prepared evidence in advance within Google Drive and asked us to review it” ahead of meetings.  

For example, “a week prior to stage 2 fieldwork, we received an e-mail asking for us to review” the compiled evidence and proactively, Alikhan “started asking questions using the comments functionality” so that Haydock was able to respond accordingly. Alikhan explains, “this continued leading up to the official week of fieldwork”, although he strategically saved “the questions that are better suited for a demonstration or that required more back and forth” for their meetings. Schellman’s proactive approach and thorough preparation proved to be an efficient strategy when dealing with the complex topics that arise throughout the assessment. 

Schellman’s expertise and tailored approach also aided StackAware in figuring out how to structure a risk register, especially considering “there weren’t really any kind of certified AI impact assessments” already in place, Haydock explains. He appreciated working with Schellman to “come up with an effective way to present that information that captured all the relevant risks for the assessment and the impact assessments, which are unique to 42001.”  Combining both StackAware and Schellman’s perspectives in addressing the new standard, paired with mutual openness, collaboration, and transparency allowed for an effective audit experience. 

The Perks of Being an ISO 42001 Certification Trailblazer

All the work performed to prepare and in finding the right auditor proved well worth it, as the benefits of becoming ISO 42001 certified include proof of organizational dedication to secure and responsible AI management and development. This leads to enhanced trust with stakeholders, improved risk management, and an undeniable competitive advantage—something Haydock can attest to firsthand. 

For Haydock, StackAware becoming 42001 certified has “certainly been a business driver” as they continue to acquire more customers to work with for 42001 readiness. So much so that StackAware is hiring employees so they can help even more customers become ISO 42001 ready. That said, Haydock acknowledges the competition is fierce as more companies continue to follow their lead and join the fray.  

Nonetheless, ISO 42001 certification remains a significant business growth opportunity, and being certified early has certainly helped StackAware stand out due to the clear downstream impact on value and credibility. Still, the biggest value-add from ISO 42001certification is the third-party validation of an organization’s trustworthy AI systems and their related responsible management practices. 

Haydock explains there is a “lack of information or lack of guidance on responsible AI” and as a result, “there is a lot of variability in what companies are doing in terms of AI.” With so many companies releasing generic high-level responsible-AI statements that lack transparency, or failing to even disclose the type of AI models they use, it’s hard to know what their AI governance structure looks like. Moreover, it’s nearly impossible to know how or if they are actually being responsible with their AI use.  

But in getting the established ISO 42001 standards in place and becoming certified, organizations can “prove that you have an effective AI governance program and meet the mandatory requirements,” which will aid in building trust and scaling AI systems into the future.