42001ISO/IEC
There is now a standard for AI management
ISO/IEC 42001, published in December 2023, is the first international standard for an AI management system.
Source: ISO
- Home
- AI Advisory
- AI policy and governance
Rules for AI before AI makes its own.
Your staff are probably using AI tools already, approved or not. A clear policy decides which tools are allowed, what data they may see and who checks the output, before a client file ends up somewhere it should not.
What it covers
AI policy and governance
AI acceptable use policy
Approved tools, permitted and prohibited data, review of AI output, disclosure to clients and accountability, in a policy staff can follow.
Tool approval
A simple process to assess a new AI tool for data handling, security and contract terms before anyone uses it.
Data protection alignment
AI use checked against the Data Protection Act, client confidentiality and any regulatory obligations.
Formal frameworks
Where you need more structure, governance aligned with ISO/IEC 42001 and the NIST AI Risk Management Framework.
Staff awareness
Short training on the policy, with real examples of what is and is not allowed.
- ISO/IEC 42001
- NIST AI RMF
- Cayman Data Protection Act
How we do it
Discover
We find which AI tools are in use and what data they touch.
Decide
Management agrees approved tools and the rules for data.
Document
The policy and approval process are written and published.
Embed
Staff are trained and the policy reviewed as tools change.
Field notes
Worth knowing
1.0NIST
A free framework for AI risk
The NIST AI Risk Management Framework, released in January 2023, gives a practical structure for identifying and managing AI risks.
Source: NIST
What you receive
- AI acceptable use policy
- Approved AI tool register
- AI tool assessment checklist
- Staff training session and materials
- Governance framework, where required
Questions
Do we need an AI policy if we have not bought any AI tools?
Yes. Free AI tools are a browser tab away, and staff may already paste client information into them. A policy sets the rules now.
Should we ban AI tools?
Bans tend to push use out of sight. A short list of approved tools, with clear data rules, is usually safer and more productive.
Do we need ISO/IEC 42001 certification?
Most organisations do not. The standard is a useful reference, and certification makes sense mainly when clients or regulators ask for it.
More on AI Advisory
Talk to us about AI policy and governance
Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.
info@gabcoenterprises.com+1 345 769 4222