The purpose of ISO/IEC 42001 is to guide organisations on how to manage their AI (artificial intelligence) systems. This is important since the use of AI and ML (machine learning, which is a subset of AI of fundamental importance) raises several questions, including those regarding:

The relative transparency and explainability of automated decision systems.
The use of outputs such as data analysis from ML systems, which are trained from data, once or continuously, and adapt to changes in its inputs. This differs from traditional procedural programming, since an AI system may change its behaviour over the course of its use.
The degree of autonomy of an AI system, as in autonomous driving vehicles.

In the Data Science Department at the National Physical Laboratory (NPL), we are investigating AI and ML systems in the context of metrology (the science of measurement), which can provide accurate measurements underpinning our confidence in the data used by such systems.

Defining Trustworthiness

In a broad sense an organisation should aim for their AI systems to be trustworthy. One may consider a person to be “trustworthy” if that person is reliable, responsible, and dependable. For AI systems the notion of trustworthiness is more complex and includes ethical, technical and risk related components.

There is a technical report, ISO/IEC TR 24028, which deals with some of these issues. However, to have a better understanding of trustworthy AI it is important to look at publications from several sources, as there is no definitive agreement on its precise definition.

Managing AI systems using ISO/IEC 42001

The emphasis of ISO/IEC 42001 is on integrating an AI management system with the organisation’s existing structures. In the standard, a management system is defined as ”interrelated or interacting elements in an organisation to establish policies and objectives, as well as processes to achieve the objectives”.

To capture the components of a management system, the body of the standard is relatively generic, and we are referred to the standard’s annexes as well as other ISO/IEC documents to get the AI perspective. One way to look at it is a tick list for an organisation relating to their AI system. Much of this is exactly what an organisation should be doing for the management of all their computer systems, regardless of whether it contains an AI component. An interesting point is that ML is not mentioned in the body of the standard, rather this is left to the annexes.

ISO/IEC 42001 for governance and trust

The standard has four annexes. Trustworthy AI is mentioned in annex A as part of the management guide for AI system development. In annex B, which deals with the implementation guidance for AI controls, there is further mention of specific measures pertaining to AI/ML. (A control is a measure that maintains and/or modifies risk.) In particular, it is mandated that documentation of data used in the organisation should include the categories used for ML, and the process of labelling the data for training and testing.

In terms of assessing the impact of AI systems on groups and individuals, the standard mentions several areas of trustworthiness such as fairness, transparency, explainability, accessibility and safety. Many other important areas of impact are mentioned such as the effect on the environment, potential misinformation, and possible adverse safety and health issues. However, these are relevant to software systems in general and not just to AI systems.

An interesting control is to provide justification for the development of an AI system, including an explanation of when and why the system will be used and a list of metrics that should be used to measure whether the system’s performance is compatible with these objectives. A question arising from this is whether known metrics that are used for software systems are sufficient for systems that contain AI.

In addition, the design choices need to be documented, which includes detail on the ML method. In this respect evaluation of the AI system is also important and will include AI specific measures.

Although not mentioned in the standard, generalisability is very important for AI systems, that is how does the statistical model built by the ML methods employed adapt to new data that was previously unseen. For deployment the model built by the machine learning may need to be periodically, or even continuously, retrained. Therefore, the AI system needs to monitored on an ongoing basis to assess the effect the system’s performance.

Data management and responsible AI

Annex B also addresses the data management processes that should be put in place. These cover specific guidance for AI systems that include transparency, explainability, and sample training data. It also includes guidance for data preparation, which includes statistical exploration of the data, a fundamental activity in data science. Responsible use of AI is also addressed, the objective being that the AI system should be trustworthy along multiple dimensions including fairness, accountability, transparency, reliability, robustness, safety, privacy, security, and accessibility.

The dimensions of trustworthiness also apply to the subject of annex C, which addresses AI-related organisational objectives and risk sources.

Finally, annex D is about the domains and sectors in which an AI system may be used. The problem addressed is the integration of sector specific standards with this general AI standard. Annex D also deals with certification, pointing to an approach for third-party conformity assessment on the basis of the AI management standard.

As a whole ISO/IEC 42001 offers organisations both the guidance for their existing technical stacks as well as the standards and processes needed for the AI deployment built atop them to be trustworthy, along its various dimensions, some of which were mentioned above.

Trustworthy AI is one of the main themes we are researching at NPL, as it is of prime importance to ensure that any measurement system that includes an AI component adheres to the underlying principles of responsible AI. In a future blog post, we will look more closely at how ISO/IEC 42001 might be useful for an organisation looking to benefit from using AI and machine learning in their operations.

||||I|||| * About + The AI Standards Hub + National AI Strategy * Observatory + Standards database + Policy database * Forums * Training + “Standards at a glance” + Training database * Research * Events * News / Blog + Blog + Newsletters * Login + Log In Username or Email address: Password: Keep me signed in Forgot password Log In Create an account * Create an account Select Page * * Content Type Posts Pages Forums Topics Standards Policy item Events Research and analysis item Training Resource 101 Back to all blog posts How ISO/IEC 42001 guides organisations toward Trustworthy AI Blog post by Professor Mark Levene Principal Research Scientist, NPL The purpose of ISO/IEC 42001 is to guide organisations on how to manage their AI (artificial intelligence) systems. This is important since the use of AI and ML (machine learning, which is a subset of AI of fundamental importance) raises several questions, including those regarding: * The relative transparency and explainability of automated decision systems. * The use of outputs such as data analysis from ML systems, which are trained from data, once or continuously, and adapt to changes in its inputs. This differs from traditional procedural programming, since an AI system may change its behaviour over the course of its use. * The degree of autonomy of an AI system, as in autonomous driving vehicles. In the Data Science Department at the National Physical Laboratory (NPL), we are investigating AI and ML systems in the context of metrology (the science of measurement), which can provide accurate measurements underpinning our confidence in the data used by such systems. Defining Trustworthiness In a broad sense an organisation should aim for their AI systems to be trustworthy. One may consider a person to be “trustworthy” if that person is reliable, responsible, and dependable. For AI systems the notion of trustworthiness is more complex and includes ethical, technical and risk related components. There is a technical report, ISO/IEC TR 24028, which deals with some of these issues. However, to have a better understanding of trustworthy AI it is important to look at publications from several sources, as there is no definitive agreement on its precise definition. Managing AI systems using ISO/IEC 42001 The emphasis of ISO/IEC 42001 is on integrating an AI management system with the organisation’s existing structures. In the standard, a management system is defined as ”interrelated or interacting elements in an organisation to establish policies and objectives, as well as processes to achieve the objectives”. To capture the components of a management system, the body of the standard is relatively generic, and we are referred to the standard’s annexes as well as other ISO/IEC documents to get the AI perspective. One way to look at it is a tick list for an organisation relating to their AI system. Much of this is exactly what an organisation should be doing for the management of all their computer systems, regardless of whether it contains an AI component. An interesting point is that ML is not mentioned in the body of the standard, rather this is left to the annexes. ISO/IEC 42001 for governance and trust The standard has four annexes. Trustworthy AI is mentioned in annex A as part of the management guide for AI system development. In annex B, which deals with the implementation guidance for AI controls, there is further mention of specific measures pertaining to AI/ML. (A control is a measure that maintains and/or modifies risk.) In particular, it is mandated that documentation of data used in the organisation should include the categories used for ML, and the process of labelling the data for training and testing. In terms of assessing the impact of AI systems on groups and individuals, the standard mentions several areas of trustworthiness such as fairness, transparency, explainability, accessibility and safety. Many other important areas of impact are mentioned such as the effect on the environment, potential misinformation, and possible adverse safety and health issues. However, these are relevant to software systems in general and not just to AI systems. An interesting control is to provide justification for the development of an AI system, including an explanation of when and why the system will be used and a list of metrics that should be used to measure whether the system’s performance is compatible with these objectives. A question arising from this is whether known metrics that are used for software systems are sufficient for systems that contain AI. In addition, the design choices need to be documented, which includes detail on the ML method. In this respect evaluation of the AI system is also important and will include AI specific measures. Although not mentioned in the standard, generalisability is very important for AI systems, that is how does the statistical model built by the ML methods employed adapt to new data that was previously unseen. For deployment the model built by the machine learning may need to be periodically, or even continuously, retrained. Therefore, the AI system needs to monitored on an ongoing basis to assess the effect the system’s performance. Data management and responsible AI Annex B also addresses the data management processes that should be put in place. These cover specific guidance for AI systems that include transparency, explainability, and sample training data. It also includes guidance for data preparation, which includes statistical exploration of the data, a fundamental activity in data science. Responsible use of AI is also addressed, the objective being that the AI system should be trustworthy along multiple dimensions including fairness, accountability, transparency, reliability, robustness, safety, privacy, security, and accessibility. The dimensions of trustworthiness also apply to the subject of annex C, which addresses AI-related organisational objectives and risk sources. Finally, annex D is about the domains and sectors in which an AI system may be used. The problem addressed is the integration of sector specific standards with this general AI standard. Annex D also deals with certification, pointing to an approach for third-party conformity assessment on the basis of the AI management standard. As a whole ISO/IEC 42001 offers organisations both the guidance for their existing technical stacks as well as the standards and processes needed for the AI deployment built atop them to be trustworthy, along its various dimensions, some of which were mentioned above. Trustworthy AI is one of the main themes we are researching at NPL, as it is of prime importance to ensure that any measurement system that includes an AI component adheres to the underlying principles of responsible AI. In a future blog post, we will look more closely at how ISO/IEC 42001 might be useful for an organisation looking to benefit from using AI and machine learning in their operations. Share on TwitterShare on LinkedIn 0 Comments Submit a Comment You must be logged in to post a comment. Led by Partnering with © 2022 The Alan Turing Institute * Follow * Follow Privacy Notice Cookie Notice Terms and Conditions Terms of acceptable use Contact us Site feedback Close Report abuse We are committed to ensuring that the AI Standards Hub platform provides a safe experience for all users. Where we determine that content violates our rules, we will work to remove it and may take further action including suspending the relevant user account. Please complete the form below to report this contribution if you have observed or suspect a violation. If there is immediate danger, please call your local emergency services in addition to reporting. You can review our Terms of Acceptable Use here. More information about reporting harmful content can be found here. URL where abuse took place What kind of issue are you reporting? What kind of issue are you reporting? Spam Violation of privacy, confidentiality, or data protection legislation Infringement of intellectual property rights Deception or impersonation Defamatory content Offensive, hateful, or inflammatory content Bullying, intimidation, or harassment Threatening or abusive behaviour Promotion of unlawful activity Violent or sexually explicit content Content relating to or encouraging self-harm or suicide Other forms of harm or problematic content Please share any additional information to help us deal with the issue. For example, the user involved, nature of content or time and date of content posting. Report Report submitted We appreciate you taking the time to submit this report. Thank you for helping to make the AI Standards Hub safer for everyone. Close Close Provide feedback on the site Please use the form below below to provide your thoughts on what works and doesn’t work on the site. This helps the Hub to continuously improve, so we appreciate any feedback you can provide. URL where the issue occured Type of issue Type of issueProvide a complimentIdentify a website issue or bugSuggest changes to functionalitySuggest changes to designOther feedback What were you trying to do? What went wrong? Submit Feedback submitted We appreciate you taking the time to submit this feedback. Thank you for helping to improve the AI Standards Hub. Close Close Submit a missing item Please suggest any standards, documents or other items that would be a good addition to the website repositories. Type of content that is missing Type of content that is missingAI StandardPolicy itemTrainingResearch and AnalysisEvent Relevant URL of missing content Why is this content relevant to the site? Submit Feedback submitted We appreciate you taking the time to submit this feedback. Thank you for helping to improve the AI Standards Hub. Close Close GDPR Cookie Settings * Privacy Overview * Strictly Necessary Cookies * 3rd Party Cookies Powered by GDPR Cookie Compliance Privacy Overview This website uses cookies so that we can provide you with the best user experience possible. You can see our cookie notice here, and our privacy notice here. Enable All Reject All Save Changes

Search across your past Websets

Articles: ISO/IEC 42001, published in 2024-2025

Search Criteria

Enrichments

Find more results