Managing AI Technology in A Way That Makes Your Clients Trust You – Part 3

Thomas Dold I 21st November 2024

The explosion of Artificial Intelligence (AI) technology is taking the world by storm. However, there is a lot of apprehension around the amount of data it possesses, the confidentiality of the data and the potential impacts of the data. 

Here in comes ISO 42001:2023 – Artificial Intelligence Management System. This ISO Standard looks to ensure organisations are appropriately controlling their use or development of AI by taking in the potential “Impacts” the AI technology could have. 

In part 3 of this series, we will look to break down how the ISO 42001:2023 has organisations manage the Support and Operations sections of the standard. 

Support

Resources  

To ensure that your organisation can maintain compliance with the AI Management System and continually improve how it operates, the organisation needs to ensure that there are appropriate resources allocated. These can be technical, people, internal or external. As long as the management system can be effectively managed and maintained.

Competence

Now that the appropriate resources have been determined, your organisation needs to ensure that any people involved are trained/experienced to what they determine is an acceptable level. Where possible appropriate evidence of these competencies must be tracked and maintained.

Awareness

When implementing an AI Management System in the organisation, all staff need to be made aware of it, what the policy is and their role in maintaining it. It needs to be made clear what the implications are for not conforming with the policies and how to go about reporting any issues or improvements.

Communication

As with most things, communication is key, as part of the AI Management System the organisation needs to determine the relevant internal and external communications that will be needed as part of it.

When determining these, there are 4 key components you must include. These are:

• What you will communicate

• When you will communicate

• Whom you will communicate with

• How you will communicate

Documented Information

When creating documentation such as policies, standards, procedures or processes related to the AI Management System, they need to be managed and controlled in a consistent manner.

This is simply content such as consistent title structure, version control, date, change history and approval.

The documents need to be reviewed regularly and made available to all necessary personal, so controlling the distribution of documentation is also important to capture where possible.

Operations

Operational Planning and Control

The AI Management System needs to determine the controls in scope from the Annex A and establish the criteria for the processes. Then implement the controls in accordance with the criteria you have set. We will dive deeper into the controls and how to implement them in Part 5 of this series.

AI Risk Assessment

The organisation at regular planned intervals or when there is notable change to a process, needs to conduct risk assessments to ensure that there are no new unacceptable risks being identified. The organisation must retain documented results of the risk assessments taking place.

AI Risk Treatment

The organisation needs to determine the treatment plan for all identified risks, common methods for this are methodologies such as:

• Treat

• Terminate

• Tolerate

• Transfer

This lets you direct the intention of your plan to manage the risk, from there, depending on the choice you will determine a more formalised plan for reducing the risk. Treatment plans need to be reviewed for effectiveness and revalidated if the intended outcome has not been met.

AI System Impact Assessment

Similar to what was discussed in Part 2, this section simply wants to ensure that impact assessments are carried out at regularly planned intervals and whenever a notable change to the AI Management System takes place.

‍