How to Approach Evolving AI Regulation in 2025
Cybersecurity Assessments | ISO Certifications | Artificial Intelligence
Looking back, 2024 was the year of AI governance. At Schellman, we dove in headfirst and became the first ANAB ISO 42001-accredited Certification Body. We also started to see AI regulation come online internationally with the EU AI Act, as well as here in the U.S., where certain states also published their own AI regulation. While we're still lacking federal-level legislation—which may still come in the future—we also anticipate that this state-by-state patchwork of AI laws will expand.
Anticipating Emerging AI Regulation
So, how should organizations proceed as they attempt to comply with the regulations already in effect here in the U.S. and those internationally like the EU AI Act, all while anticipating the others that are likely on the way?
The good news is that there are some common themes and requirements behind these published AI regulations, such as:
- The establishment of an overall AI governance program within your organization for managing risks (That aligns very well with ISO 42001 and its required AIMS, and the EU AI Act also mentions a quality management system which points back to 9001 as being an interplay here.)
- AI red teaming, penetration testing, and more technical vulnerability assessments against your AI system
- Accountability within your organization, as well as providing general notice and awareness and disclaimers to end users whenever AI systems are being used
- The prevention of bias within your AI systems for foreseeable risks
ISO 42001 as a Potential, Comprehensive Compliance Solution
ISO 42001 can be a great tool in complying with these regulations because it, in and of itself, has a management system standard that's based around a risk assessment process and also caters to your role as a producer, a provider, and/or a user.
As several of these regulations also cater to your role as a deployer or a developer of these AI systems, getting certified will likely complement your compliance with these regulations quite well and set you up well for future, emerging governance.
Navigating the AI Regulatory Landscape
Going into 2025, we're excited to continue to be at the forefront of ISO 42001 certification services.
We've already gotten started assisting our clients and prospects as they look for ways to continue to mature their programs and comply with these upcoming and emerging regulations, including through our ISO 42001 services, and if you're also looking for a trusted partner to help you, contact us today.
About Schellman
Schellman is a leading provider of attestation and compliance services. We are the only company in the world that is a CPA firm, a globally licensed PCI Qualified Security Assessor, an ISO Certification Body, HITRUST CSF Assessor, a FedRAMP 3PAO, and most recently, an APEC Accountability Agent. Renowned for expertise tempered by practical experience, Schellman's professionals provide superior client service balanced by steadfast independence. Our approach builds successful, long-term relationships and allows our clients to achieve multiple compliance objectives through a single third-party assessor.