ISO / IEC 42001:2023
Information technology — Artificial intelligence — Management system
This ISO standard is pretty hard to digest for a MINT / SMET person like me:
Artificial Intelligence AI has been squeezed into the form of a management system of the ISO 9001:2015 style, the harmonized structure usually shared by the management objects, such as quality, environment, energy and many others.
For me, Artificial Intelligence AI is a tool, maybe a “smart” tool, may be an “intelligent” search engine, may be even a “ghost writer” and a buddy.
Moreover, the ISO 42001:2023 standard states more than 100 times !!! the term „shall“ in chapters 1 to 10 (on 16 !!! pages), denoting binding requirements and more than 100 times !!! the term „should“ in the appendices A to C (on 35 !!! pages) of the standard, denoting non-binding recommendations. The appendices are a kind of a how-to textbook.
Based on the above binding requirements, an „artificial intelligence management system“ can be subject of a formal certification.
But: Is Artificial Intelligence AI a management object from the category “value”, like “Quality = value”, “Environment = value”, “Energy = value”, and many others?
The ISO 42001:2023 is uses terms, definitions and explanations from ISO / IEC 22989:2022 Information technology — Artificial intelligence — Artificial intelligence concepts and terminology.
Artificial Intelligence AI is not defined / not explained in Chapter 3 Terms and definitions in ISO 42001:2023.
Artificial Intelligence system / AI system is defined in Chapter 3 Terms and definitions in ISO / IEC 22989:2022.
Zitat Anfang <<
3.1.4
artificial intelligence system
AI system
engineered system that generates outputs such as content, forecasts, recommendations or decisions for a given set of human-defined objectives
>> Ende Zitat
The major operational emphasis phrased in the ISO 42001:2023 is put on the management of risk in the context of Artificial Intelligence AI as seen in chapter 6 Planning and in chapter 8 Operation.
In sub-chapter 6.1 Actions to address risks and opportunities, the standard used the term “opportunities”. This term opportunity is not defined in the ISO 42001:2023.
This makes me speechless !!!