Many organisations working with ISO 27001 find that ISO 42001 feels familiar. Both standards are built on the same principles of management commitment, risk management and continual improvement.

Nevertheless, ISO 42001 is more than an AI version of ISO 27001. The standard introduces several controls developed specifically for the challenges that artificial intelligence creates. It is not only about information security, but also about consequences for people, data quality, transparency and the responsible use of AI.

Here are seven of the most important control areas that distinguish ISO 42001 from traditional management systems.

A central requirement in ISO 42001 is that the organisation must assess the consequences AI systems may have for individuals, groups and society as a whole.

An AI system can function technically as expected whilst simultaneously creating unintended consequences. For example, it may affect recruitment processes, customer handling or the basis for decisions in ways the organisation had not foreseen.

This perspective is far less prominent in ISO 27001, where the primary focus is on protecting information and reducing security risk.

ISO 42001 places significant emphasis on how AI systems are developed.

The organisation must define objectives and processes for responsible development, so that considerations such as quality, reliability, security and ethical factors become an integral part of the development work.

This is an important distinction from traditional IT systems. For AI, risk is not only about the technology itself, but also about how the system is designed, trained and deployed.

Traditional software is tested to ensure it functions as expected. For AI, this is not sufficient.

An AI system can be technically correct and still produce misleading or undesirable results. ISO 42001 therefore requires verification and validation throughout the entire lifecycle.

The organisation must be able to document how the AI system has been tested, which criteria have been used and how the results have been assessed.

A common misconception is that AI risk is assessed once at the point of implementation.

In practice, AI systems can change in character over time. The underlying data can evolve, usage patterns can shift, and results can deteriorate below expectations.

ISO 42001 therefore requires the organisation to establish processes for ongoing monitoring of AI systems’ performance and behaviour.

This is an area in which many organisations currently have limited experience.

The quality of an AI system is closely linked to the quality of the data it is built on.

ISO 42001 therefore includes several controls relating to data collection, data quality, data management and documentation of data provenance.

For many organisations, this will be one of the most demanding areas. It is often easier to procure an AI tool than to document the quality of the data used to train, configure or operate it.

Poor data rarely produces good AI results.

Users and other stakeholders must understand how AI systems affect them.

ISO 42001 therefore emphasises documentation, information for users and reporting of unintended consequences.

This is not necessarily about explaining every technical detail, but about providing sufficient information for users to understand the system’s purpose, limitations and risks.

Transparency is becoming increasingly important as AI is adopted in more business-critical processes.

An AI system should be used for the purpose for which it was developed or assessed.

This may seem self-evident, but in practice many organisations find that employees start using AI tools in new areas without the risks having been assessed in advance.

A tool approved to assist with content production suddenly gets used as a decision-support tool, analytical tool or source of professional judgements.

ISO 42001 addresses this challenge by requiring the organisation to maintain control over what AI systems are actually being used for.

Organisations already working with ISO 27001 will recognise many of the principles in ISO 42001. Both standards are concerned with governance, accountability and risk management.

At the same time, ISO 42001 introduces several new perspectives specific to artificial intelligence. Impact assessments, data quality, transparency and responsible use are areas that rarely receive the same degree of attention in traditional management systems.

It is precisely these controls that make AI governance something more than information security. The goal is not only to protect the organisation against risk, but also to ensure that AI systems are developed and used in a responsible, verifiable and trustworthy manner.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!

The AI Act (EU AI Act) has been adopted in the EU and is expected to be incorporated into the EEA Agreement. At the same time, the use of artificial intelligence is growing rapidly in both the public and private sectors.

For many leaders, the question is no longer whether the organisation uses AI, but how much it is used, which processes it affects, and which requirements may become relevant when the regulation takes effect.

The challenge is that many organisations lack sufficient visibility to be able to answer these questions. This is where AI Act readiness comes in.

AI Act readiness is a structured assessment of an organisation’s use of artificial intelligence, with the aim of identifying how the AI Act may affect the organisation.

The assessment gives leadership a basis for understanding:

• which AI systems are in use
• which processes are affected by AI
• which parts of the organisation may be subject to stricter requirements
• which actions should be prioritised going forward

The goal is not to document full compliance with the AI Act. The goal is to gain sufficient visibility and understanding to plan further work in a risk-based manner.

For most organisations, the greatest challenge will not be writing documentation or establishing new procedures. The greatest challenge will be understanding how artificial intelligence is actually being used within the organisation.

The larger the organisation, the more difficult this becomes.

AI is used today through:

• generative AI tools such as ChatGPT, Copilot and Gemini
• AI features in existing business systems
• analytical and decision-support tools
• supplier solutions that contain AI functionality

Many organisations may therefore have a significantly larger AI portfolio than leadership is aware of.

The AI Act is risk-based, and the implications of the regulation depend largely on how AI is used. This means no one can determine how significant the AI Act will be without first mapping the organisation’s AI portfolio.

A typical assessment will cover the following.

Which AI solutions exist within the organisation?

Which processes, decisions and tasks are affected by AI?

Could any of the solutions fall within the high-risk categories of the AI Act?

Does the organisation have adequate guidelines, roles and processes for AI use?

Which areas should be prioritised going forward?

It is easy to jump straight into discussions about AI governance, AI policy or ISO 42001.

For many organisations, however, it is difficult to know which actions are necessary before they have gained an overview of the current situation.

An AI Act readiness assessment gives leadership a fact-based foundation for assessing risk, priorities and further work.

For some organisations, the assessment will show that current AI use represents limited regulatory risk. For others, it may reveal the need for more extensive action relating to governance, documentation and internal control.

The AI Act will not affect all organisations in the same way. The significance of the regulation depends on the organisation’s AI portfolio, use cases and risk profile.

Therefore, the first and most important step is to establish visibility.

Organisations that begin this work early will be better placed to meet both regulatory requirements and the continued development of artificial intelligence.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!

Artificial intelligence is finding its way into an ever-growing number of business processes. Employees use AI to write, analyse, summarise, search for information and generate decision support. Many organisations are also experimenting with AI solutions that integrate with internal systems, documents and workflows.

For many leaders, AI feels primarily like a new type of software. But this is precisely where much of the challenge lies. AI works in a fundamentally different way from most of the systems organisations are accustomed to managing and controlling.

Traditional software follows rules. AI works with probabilities. Traditional systems are built to be predictable. AI is built to handle uncertainty. This gives rise to risks that many leaders have not previously had to contend with.

Most IT systems are deterministic. This means that the same input normally produces the same output.

If a customer orders a product, the order is recorded. If an invoice is overdue, a reminder is sent. If a user lacks access, they cannot log in. The system does what it is programmed to do.

Modern AI works differently. A language model is not built around fixed rules for every possible situation. It is trained on enormous volumes of text and calculates which responses are statistically most likely based on what it has learned.

The result is that AI can solve tasks it has never explicitly been programmed to handle. At the same time, its behaviour becomes less predictable. Two people can ask roughly the same question and receive different answers. Small changes in phrasing or context can significantly affect the outcome.

This is not necessarily a flaw in the technology. It is a characteristic of how modern AI works. But it means that AI must be assessed differently from traditional systems built around fixed rules and predictable processes.

One of the most widely discussed risks of generative AI is hallucinations.

The term describes situations where an AI model produces information that appears plausible and convincing but is actually incorrect. The model can fabricate sources, references, events, quotations or facts without understanding that the information is false.

For many leaders, this is an unfamiliar type of error. When an accounting system calculates the wrong VAT, it is perceived as a system fault. When an AI model presents incorrect information, it can do so in a way that appears both logical, well-structured and professionally credible.

The problem is therefore not simply that AI can be wrong. The problem is that the errors are often difficult to detect.

This is because language models are not built to assess what is true. They are built to generate the most probable answer based on the patterns they learned during training. In most cases, this produces impressive results. But when the model lacks information or misunderstands the context, it can produce answers that appear correct without being so.

AI models are a product of the data they learn from.

If the underlying data is incomplete, outdated or contains systematic biases, this will often affect the results the model produces. This applies both to general language models and to organisation-specific AI solutions that are trained or fine-tuned on internal data.

Bias is one of the most commonly used terms in AI risk. It describes situations where a model systematically favours or discriminates against certain groups, perspectives or outcomes.

In practice, the challenge is often more complex than the model simply being “biased”. The model largely reflects the patterns it finds in the data it has been exposed to. If historical data contains biases, AI can perpetuate or amplify them.

Data quality is therefore not only about having correct data. It is also about representativeness, relevance and context. Two models using the same technology can produce very different results depending on the data they are built on.

In many organisations, it is important to be able to explain why a decision was made. This is particularly true in quality, audit, compliance, information security and other areas where traceability is central. AI challenges this principle.

Many modern models function as what is often referred to as a “black box”. You can observe which data goes in, and you can see the result that comes out. But it is not always possible to explain exactly how the model arrived at its conclusion.

This does not mean that AI is necessarily uncontrollable. But it does mean that explainability is often weaker than in traditional rule-based systems.

The more advanced the model becomes, the more difficult it can be to understand which factors influenced the result. For organisations that depend on documentation, audit trails and verifiability, this represents a new type of challenge that many have not previously encountered.

Perhaps the most underestimated AI risk is not about algorithms or technology. It is about people.

Automation bias is an established term in decision support research, describing people’s tendency to place excessive trust in recommendations from technological systems.

This phenomenon is not new. It has been observed in everything from aviation to medical diagnostics. But generative AI makes the issue more pressing than ever.

When an AI model delivers fast, well-formulated and apparently intelligent responses, it is natural to attribute high value to its recommendations. Over time, people can become less critical and spend less effort on their own assessments.

The risk is therefore not necessarily that AI makes decisions independently. The risk is that people gradually begin to trust the technology without carrying out the professional quality assurance the situation demands.

The better AI becomes at communicating, the more important it becomes to remember that a persuasive answer is not necessarily a correct one.

Artificial intelligence represents a significant technological leap, but it also introduces a risk landscape that differs from that of traditional software.

Hallucinations, bias, lack of explainability and automation bias are not necessarily signs that the technology is performing poorly. On the contrary, they are often a consequence of how modern AI is built and why it is so powerful.

For leaders, the task is therefore not to become experts in machine learning or neural networks. It is to understand that AI has different characteristics from the systems organisations have traditionally worked with.

The better one understands these characteristics, the better placed one is to assess both the opportunities and the limitations the technology brings.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!