Does My Business Need ISO 42001 Just Because We Use AI?
Artificial intelligence is quickly becoming part of everyday business. Employees are using tools such as ChatGPT, Microsoft Copilot and AI-powered software to draft content, analyse information and automate routine tasks.
This has also led to growing interest in ISO/IEC 42001, the international standard for Artificial Intelligence Management Systems.
But does using AI mean your business needs ISO 42001 certification?
The short answer is no - not automatically.
Do I Need ISO 42001?
What is ISO 42001?
ISO 42001 provides a framework for managing the responsible development, provision and use of AI systems.
It helps organisations establish appropriate oversight, identify AI-related risks, define responsibilities and consider matters such as transparency, data quality, human review and the potential impact of AI on individuals and society.
Like ISO 9001 and ISO 27001, it is a management system standard. It certifies how an organisation manages AI; it does not certify that a particular AI tool is accurate, ethical or completely risk-free.
Using AI does not automatically require certification
An organisation occasionally using ChatGPT to help draft internal content is in a very different position from a business developing AI software or using AI to make decisions about recruitment, finance, healthcare or customers.
Certification may be worth considering where:
AI is central to the product or service being provided.
AI influences decisions that could significantly affect people.
Sensitive or personal information is processed using AI.
Customers or tendering authorities require evidence of AI governance.
The organisation develops or provides AI systems.
AI-related risks are significant enough to require a formal management framework.
For many smaller businesses, immediate certification may be disproportionate. The priority should be understanding how AI is actually being used and putting suitable controls around it.
What should businesses have in place?
Even where ISO 42001 certification is not required, uncontrolled AI use can create genuine risks.
Businesses should consider:
Which AI tools employees are permitted to use.
What information must not be entered into public AI systems.
Whether AI-generated work is independently checked.
Who remains accountable for decisions supported by AI.
How confidential, personal and customer information is protected.
Whether AI suppliers have been appropriately reviewed.
How errors, misleading outputs or inappropriate use will be reported.
A short AI usage policy, basic risk assessment, approved-tools list and clear human-review requirements may be a sensible starting point.
What if the business already has ISO 27001?
ISO 27001 provides useful foundations through information security risk assessment, access control, supplier management, incident reporting and the protection of information.
However, ISO 27001 and ISO 42001 are not interchangeable.
ISO 27001 concentrates on protecting information, while ISO 42001 addresses the wider governance and impact of AI. An existing Information Security Management System may make integration easier, but it does not automatically demonstrate conformity with ISO 42001.
Start with the risk - not the certificate
Businesses should not rush into ISO 42001 simply because employees use AI or because certification is being heavily promoted.
Start by identifying where AI is used, what information it processes, what decisions it supports and what could go wrong. From there, the organisation can determine whether proportionate internal controls are sufficient or whether a formal Artificial Intelligence Management System would provide real value.
As with any ISO standard, certification should address a genuine business need, not become another badge pursued without first understanding the risks.
If you would like to discuss how AI fits within your existing management system, or have questions about whether ISO 42001 may be relevant to your business, contact us to find out more.
Comments