What is ISO/IEC 42001?
The standard
ISO/IEC 42001 is the first international standard for an AI management system. ISO and the IEC published it in December 2023. It sets out how an organisation should govern the AI it builds or uses: who is accountable, how risks and impacts are assessed, which controls apply across the AI lifecycle, how people oversee it, and how it is monitored and improved.
Like ISO/IEC 27001 for information security, it can be certified by an accredited auditor.
Why it matters to your firm
- It gives your risk and compliance team a recognised yardstick for judging an AI supplier.
- It answers the AI questions in vendor due diligence with a framework, not a questionnaire.
- It covers the controls AI regulation is moving towards, such as risk assessment and human oversight.
Where we are
Lynctera's ISO/IEC 42001 programme is in progress. We are not certified, and we have not set a public date. What is already in place:
- An impact assessment on file for each AI agent we run.
- A person signs off before anything consequential happens, and every decision is recorded.
- New AI tasks are assessed and approved before they run.
- Anyone can report an adverse impact of our AI through Yellow Be's reporting form.
How it fits with SOC 2
Our SOC 2 Type II audit is complete: it covers how we keep the service and your data secure. ISO/IEC 42001 covers how the AI itself is governed. The two answer different questions, and a regulated firm usually asks both. The SOC 2 report is available on request through the Yellow Be trust centre.
Once ISO/IEC 42001 is in place, we intend to pursue ISO/IEC 27001, the international standard for information security management. Because the two ISO standards share a structure, much of the management system built for one serves the other. We have not set a public date.