Reading time: ~ 3 min.

• ISO/IEC 38507:2022
• ISO 38500
• ISO 42001:2023
• ISO/IEC 28394:2023
  

The ISO/IEC 38507:2022 standard on «Information technology — Governance of IT — Governance implications of the use of artificial intelligence by Organizations» provides guidelines addressed to governing body of organizations that use artificial intelligence.

The documentation is useful to implement an effective, efficient and acceptable use of the AI within the organization. The standard can be applied to ensure the governance of current and future uses of artificial intelligence as well as the implications of such use for the organization itself.

✅ 1 Scope
✅ 2 Normative references
✅ 3 Terms and definitions
✅ 3.1 Terms related to Al
✅ 3.2 Terms related to governance
✅ 4 Governance implications of the organizational use of Al
✅ 4.1 General
✅ 4.2 Maintaining governance when introducing Al
✅ 4.3 Maintaining accountability when introducing Al
✅ 5 Overview of Al and Al systems
✅ 5.1 General
✅ 5.2 How Al systems differ from other information technologies
✅ 5.3 Al ecosystem
✅ 5.4 Benefits of the use of Al
✅ 5.5 Constraints on the use of Al
✅ 6 Policies to address use of Al
✅ 6.1 General
✅ 6.2 Governance oversight of Al
✅ 6.3 Governance of decision-making
✅ 6.4 Governance of data use
✅ 6.5 Culture and values
✅ 6.6 Compliance
✅ 6.7 Risk
✅ Annex A Governance and organizational decision-making
✅ A.1 Overview of relevant governance standards
✅ A. 2 Governing body guidance over management decisions
✅ A.3 Governance of data use

Reading time: ~ 2 min.

Reading time: ~ 4 min.

We just did a brief examination of the Chapter 4 of the FINMA Circular 23/01, but we should keep in mind too that there are other regulations that the document set.

If we take the «Chapter V», we noticed that this one relates to the need of «Ensuring operational resilience».

At this point, we can just have a big question for our compliance strategy: how to can we systematically manage the requirements of the Circular 2023/01 applicabile to the ICT resources?

It is probably correct to say that a modern GRC approach – base on the main ISO standards we can put in relation with the matter – can help us on supporting the integrated management of all the requirements applicable to ICT resources, which are:

We should now figure out which ones are the ISO standards we can rely on to manage the requirements; and these are indeed:

• ISO 38500, for the Governance;
• ISO 31000, for the Risk Management;
• ISO 37301, for the Compliance Management.
  

We should remember also that a modern GRC approach allows indeed the adoption and of course the integration of the several reference standards (E.G. ISO standards and the NIST standards), as follows:

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic.