itSMF Switzerland - Blog #ISO42001:2023

The management systems for artificial intelligence ISO 42001:2023 and risk treatment according the Annex A

Wed, 19 Mar 2025 07:00:00 +0100

Reading time: ~ 2 min.

The management systems for AI and risk treatment: the ISO 42001 standard

In our previous post, we took a look at the ISO 42001:2023 standard focusing on the tools that organizations can use to implement security, protection, equity, transparency and data quality for AI based products or services.

Today we're going to consider in particular the «Annex A» of the latest version of the ISO standard on management systems for AI: the document reports a series of control objectives and operational controls that as an organization we can apply to address risks.

The ISO 42001 standard and the Annex A: control objectives and operational controls

On the ISO/IEC 42001:2023 standard «ANNEX A» we have a series of controls objectives and operational controls useful to support an organization that needs to manage and mitigate AI systems related risks (risk treatment and management).

This is the structure of the Annex A:

A.2 «Policies related to AI»
A.3 «Internal Organization»
A.4 «Resources for AI Systems»
A.5 «Assessing Impact of AI Systems»
A.6 «AI System Life Cycle»
A.7 «Data for AI System»
A.8 «Information for parties interested in AI systems»
A.9 «Use of AI systems»
A.10 «Third parties and customer relationships».

In the nex lines, let's have a quick overview on the controls, one by one.

Annex A, Control A.2 «Policies related to AI»

According to the ISO 42001 standard control A.2, the policy for AI systems development and use is the pillar on the approach that an organization can adopt for AI governance.

Annex A, Control A.3 «Internal organization»

The control A.3 is focused on the requirement for an organization to define and allocate teams or professionals (role and responsability) in charge of the oversight of every aspects of AI system management.

Annex A, Control A.4 «Resources for AI systems»

The control A.4 sets the need to identify and document every AI system essential resource, such as data, tools, computing resources and team expertise.

Annex A, Control A.5 «Assessing impact of AI systems»

The control A.5 is focused on the need to identify, analyse, evalute and treat the AI system impacts on individuals and the society, adopting a well structured approach for the assessment.

Annex A, Control A.6 «AI system Life Cycle»

According to the Annex A control A.6, the every stage of AI system life cycle has to be managed through an approach (framework) that helps to ensure responsability and effectiveness on design, implementation and use of AI system.

Annex A, Control A.7 «Data for AI sytem»

The data quality and the source it comes from are very relevant for AI system: every organization has to manage carefully the definition and documentationabout requirements and standards.

Annex A, Control A.8 «Information for parts interested in AI systems»

According to the Annex A control A.8, organizations have to determine and share AI systems essential informations (purpose, instructions, limitations, capabilities,...) to users and other stakeholders.

Annex A, Control A.9 «Use of AI systems»

The Annex A control A.9 requires to define and document the process for the AI systems responsible use, in particular according to ethics, legal requirements and policies of the organization.

Annex A, Control A.10 «Thir parties and customer relationships»

According to the Annex A control A.10, organizations have to delineate internal and external responsabilities on AI systems, in particular among partners, suppliers and other third parties.

The correlations between ISO 42001 Annex A and other standards

We should remember that the the ISO 42001:2023 Annex A has relevant correlations with other standards, in particular the following ones:

ISO 27001 Information Security (Appendix A Operational Controls);
IT Services ISO 20000-1

If you want to keep you up-to-date with the most recent news on this topic, don't forget to subscribe to our newsletter!

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The AI governance and the main related ISO standards: 42001, 38507 and 38500

Wed, 22 Jan 2025 07:00:00 +0100

Reading time: ~ 3 min.

The artificial intelligence and the governance: the most relevant ISO standards

In the landscape of (IT or) Enterprise Service Management the artificial intelligence arises as one of the leading trend that brings a lot of innovation in the concept of IT service management, as well as big challenges regarding the governance aspects.

In our today post, we're going to take a closer look at the most relevant ISO standards that provide us useful guidelines for organizations in the implementation of the correct AI governance. Our overview will be mainly on:

ISO/IEC 38507:2022
ISO 38500
ISO 42001:2023
ISO/IEC 28394:2023

The artificial intelligence and governance according to the ISO 38507 standard

The ISO/IEC 38507:2022 standard on «Information technology — Governance of IT — Governance implications of the use of artificial intelligence by Organizations» provides guidelines addressed to governing body of organizations that use artificial intelligence.

The documentation is useful to implement an effective, efficient and acceptable use of the AI within the organization. The standard can be applied to ensure the governance of current and future uses of artificial intelligence as well as the implications of such use for the organization itself.

These are the sections of ISO/IEC 38507:2022 standard:

✅ 1 Scope
✅ 2 Normative references
✅ 3 Terms and definitions
✅ 3.1 Terms related to Al
✅ 3.2 Terms related to governance
✅ 4 Governance implications of the organizational use of Al
✅ 4.1 General
✅ 4.2 Maintaining governance when introducing Al
✅ 4.3 Maintaining accountability when introducing Al
✅ 5 Overview of Al and Al systems
✅ 5.1 General
✅ 5.2 How Al systems differ from other information technologies
✅ 5.3 Al ecosystem
✅ 5.4 Benefits of the use of Al
✅ 5.5 Constraints on the use of Al
✅ 6 Policies to address use of Al
✅ 6.1 General
✅ 6.2 Governance oversight of Al
✅ 6.3 Governance of decision-making
✅ 6.4 Governance of data use
✅ 6.5 Culture and values
✅ 6.6 Compliance
✅ 6.7 Risk
✅ Annex A Governance and organizational decision-making
✅ A.1 Overview of relevant governance standards
✅ A. 2 Governing body guidance over management decisions
✅ A.3 Governance of data use

ISO/IEC 38507 and the main correlated ISO standards

If we take a closer look at the IEC/ISO 38507:2022 standard we can find a direct relation to the ISO/IEC 42001:2023 on «Information technology Artificial intelligence Management system» (we already had a focus on our blog about this standard).

Regarding to the AI governance approach proposed in the ISO 38507 standard, we can point out that it is aligned with the one defined in the well-known ISO/IEC 38500:2015 standard on «Information technology - Governance of IT for the organization».

On the subject of risk management, the ISO 38507 recalls the IEC/ISO 28394:2023 standard on «Information technology — Artificial intelligence – Guidance on risk management».

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us on our social media channels or subscribe to our newsletter.

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Medical devices and health software: a closer look to the related ISO standards

Mon, 09 Dec 2024 22:35:01 +0100

Reading time: ~ 3 min.

Medical devices and health software: data protection and security and the main related ISO standards

The growing availability of technological solutions that can be implemented in the health industry products and services brings new challenges regarding the need of compliance to high levels of protection and security of (sensitive) data.

To manage these needs of data security and protection related to medical devices and health softwares, we can consider in particular the IEC 81001-5-12021.

In the next lines, we're going to understand how this standard can be relevant and its main correlations with the European Regulations and other ISO standards.

Medical devices and health software: IEC 81001-5-1:2021 standard

The IEC 81001-5-1:2021 on «Health software and health IT systems safety, effectiveness and security – Part 5-1: Security – Activities in the product life cycle» defines the life cycle requirements in health software development and maintenance.

This standard provides a common framework for secure health software life cycle processes, thanks to its set of processes, activities and tasks. These are the main sections of the documentation:

✅ 1 Scope

✅ 2 Normative references

✅ 3 Terms and definitions

✅ 4 General requirements

✅ 5 Software development process

✅ 6 Software maintenance process

✅ 7 Security risk management process

✅ 8 Software configuration management process
✅ 9 Software problem resolution process

✅Annex A (informative) Rationale
✅Annex B (informative) Guidance on implementation of security life cycle activities
✅Annex C (informative) Threat modelling

✅Annex D (informative) Relation to practices in IEC 62443-4-1:2018
✅ Annex E (informative) Documents specified in IEC 62443-4-1

✅Annex F (normative) Transitional health software
✅ Annex G (normative) Object identifiers

The purpose of IEC 81001-5-1:2021 standard is to increase the health software cybersecurity through activities and tasks in the health software life cycle processes as well as improving security in software life cycle processes themselves.

IEC 81001-5-1 standard and the relationship with European regulation and ISO standards

If we take a closer look at the IEC 81001-5-1 standard we can detect some natural correlations with the European regulation on Medical devices, the MDR 2017/745. The correlations are detectable both on software embedded into medical devices as well as for SaMD (Software as a Medical Device).

We can find also relevant correlations with ISO/IEC 20000-1:2018 standard on «Information technology — Service management Part 1: Service management system requirements», in this case regarding the common requirements in the software developement cycle.

If we take a glimpse in the future, we can imagine that there will be stronger correlations between the management of the software cycle and the security requirements in the development of AI solutions in medical device industry.

In this case, the correlation is between IEC 81001-5-1 and the ISO/IEC 42001:2023 standard on «Information technology — Artificial intelligence — Management system».

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us on our social media channels or subscribe to our newsletter: every month, you'll get valuable content from our experts.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The management systems for artificial intelligence according to ISO 42001:2023

Wed, 06 Mar 2024 14:25:00 +0100

Reading time: ~ 2 min.

ISO 42001 standard: the management systems for AI

The recent ISO 42001:2023 standard on Information Technology Artificial Intelligence Management Systems contains a series of tools that are useful for organizations looking for implementing security, protection, equity, transparency and data quality data for AI-based products or services.

This standard provides in particular the requirements for implementing an Artificial Intelligence Management Systems – aka «AIMS» – that is able to keep up along the entire «life cycle» of AI products or products.

In other words, ISO 42001 is useful during development, supply, use and monitoring of a product (or service even) that embeds artificial intelligence features.

The ISO 42001 standard and its HLS structure

We should keep in mind that the ISO 42001 standard implements the typical ISO High Level Structure – (HLS) – that is common to all the ISO management Systems.

In particular, we can find out that the clause 8. – on «Operation» – is divided into the following requirements:

✅ 8.1 Operational planning and control

✅ 8.2 AI Risk Assessment

✅ 8.3 Treatment of AI risk

✅ 8.4 Impact assessment of the AI system

The ISO 42001 standard: our infographic on requirements

The requirements specified on ISO 42001 standard are listed between the clauses 4 and 10, as it is common along the management systems standards.

To better figure out the «big picture», take a look at our infographic:

If you want to keep you up-to-date with the most recent news on this topic, don't forget to join our Annual Forum Day 2024.

Andrea Leonardi will held a speech on «GRC ICT: AI Management Systems ISO 42001 between Innovation (ISO 56002) & Sustainability (ISO 26000)».

DISCOVER THE ANNUAL FORUM DAY 2024 AGENDA

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors: