ISO 42001 Certification: AI Compliance or the New SOC 2?

Speaker 1 00:02

This is CyberSound, your simplified and fundamentals-focused source for all things cybersecurity.

Jason Pufahl 00:11

Welcome to CyberSound. I’m your host, Jason Pufahl. Joined today by Walter Haydock from StackAware. We’re going to spend a little bit of time, I think, talking. Actually, as we have recently, AI-related content, but in this case, more on the compliance and sort of standards space, where we’ll talk about ISO 42001.

So, Walter, thanks for joining. I appreciate taking some time today.

Walter Haydock 00:35

Jason, thank you for having me on.

Jason Pufahl 00:37

Yeah. So, I’m going to come totally clean. I wouldn’t say I had my sights set on 42001 until three, four weeks ago, when you and I met and chatted about it for a few minutes. And I realized, all right, we’ve got some, I think, some formalization in the security practices relative to AI. And it seems so relevant, because I spend a lot of time talking about AI use cases and AI risk and some of the things around that. But we haven’t really talked about what’s out there to help people actually determine how to protect themselves, how to write policies, write whatever 42001 looks like.

So, if you could spend a minute on who StackAware is, what your background is, and then we’ll kind of dive into it.

Walter Haydock 01:26

Yeah, absolutely. So, I’m the founder of StackAware, and we help AI-powered companies measure and manage cybersecurity compliance and privacy risk. We primarily focus on implementing the ISO 42001 standard for our customers to prepare them for external audit and certification. And we work with a range of companies, but primarily in the health tech, fintech, and B2B SaaS space.

Jason Pufahl 01:52

Okay. Yeah, so, how comprehensive is 42001? What is it? Is it like anything you’ve seen before?

Walter Haydock 02:05

ISO 42001 is an international standard for building an AI management system. It’s very similar in structure to ISO 27001, which is focused on information security management systems. And it is a relatively high-level document that has a variety of different supporting resources that can give you implementation guidance. But essentially, it requires that you build a governance program to help you measure and manage the risk and impacts external to the organization of using artificial intelligence. It requires you to have an internal audit program. It requires effective measurement and monitoring of key performance indicators. And it requires you to interact with your customers, your suppliers, and interested third parties in a certain way, in a structured manner to make sure that you are meeting your own requirements and managing the risk effectively.

Jason Pufahl 03:02

So I’m interested in this. This is always a question for me when you talk about some of these frameworks. Is it a set of best practices, or is it also, and I’m sure to some degree it is, but is it certifiable? Can you have a third party actually say, you’ve done the things in 42001 to give you some public way of saying, I adhere to or I am certified against 42001?

Walter Haydock 03:32

ISO 42001 is an externally certifiable standard. For example, StackAware itself is ISO 42001 certified. And you can have an external auditor come in and grant you a certification after reviewing your AI management system. It is a prescriptive standard. It does require you do certain things in certain ways. But with that said, it is flexible enough so that a small company like StackAware can get certified, but also a big company like Amazon Web Services can also get certified using ISO 42001.

Jason Pufahl 04:06

So what is an AI management system? Is that what you referred to it as? Describe that for a second. So if I’m a company that’s using Copilot, I’ve got 10 employees, we’ve got Copilot deployed, would I need to look at 42001? Or is it for somebody who’s developing AI products? Typically, where is the requirement to try to adhere to this?

Walter Haydock 04:38

ISO 42001 falls into a broader environment or ecosystem of ISO documentation, one of which is ISO 22989, which lays out six different AI roles. And three of them are probably not too germane to the conversation. They relate to data subjects and regulators. But where most companies would be focused would be on the AI provider, the AI producer, and the AI user roles. So companies that are AI users are like those that you mentioned who would be using third-party tools like Copilot or ChatGPT. An AI provider is generally a company that we might describe as AI-powered. Maybe they’re building a product on top of a third-party service. And then AI producers are most likely those that are building and training foundational models for their customers. There are some tweaks. There are some asterisks there. Interestingly enough, StackAware is certified as an AI producer because one of the subcategories is governance and oversight organization. So that is included in our scope for ISO 42001.

Jason Pufahl 05:52

Okay, so I think kind of knowing our listeners generally, most probably fall into the AI users space. At least I would think that they would. Can you spend a second on what types of things would 42001 call out relative to companies that primarily have AI users in them?

Walter Haydock 06:21

For companies that are using AI purely in a productized manner, ISO 42001 gives you a variety of things. First of all, it gives you a foundation for conducting AI risk assessments, which is obviously critical for any organization that’s using a third-party service. So understanding data retention, training policies, accuracy issues, these are all key for any organization that’s using AI. Additionally, it gives you a way to explain externally to stakeholders like customers, regulators, what have you, that you’re using artificial intelligence in a responsible and structured manner, and that you have a program to monitor how it is being rolled out. And I’m happy to give you some examples of companies that would benefit from ISO 42001 certification.

Jason Pufahl 07:10

Yeah, that’d be great.

Walter Haydock 07:14

So the three types of companies that would be most appropriate for ISO 42001 certification would be, one, AI-powered startups. Because these types of companies, like mine, for example, have limited bandwidth, they can probably only go for one framework to begin with. And ISO 42001 is actually quite a broad framework. It covers things like security and privacy, but it also covers more general topics like impacts on climate change, for example, as well as impacts on societies and individuals. So it is a very broad standard.

Second of all would be organizations that are training on customer data. And, for example, DocuSign, Slack, Zoom have all kind of gotten into a little bit of PR hot water from the way they rolled out some terms and conditions changes or how they’re training their products. And whether or not they deserve that scrutiny is a different question, but they got it nonetheless. So giving people a warm and fuzzy, so to speak, about how you’re using AI with ISO 42001 is definitely a way to go.

And then the third group of organizations that would benefit most from ISO 42001 would be health tech and financial services organizations, specifically those that are heavily regulated, that have an obligation to respond to audit requests, to provide information to regulators who are keenly interested in how the organization is using artificial intelligence. And because AI is relatively new, especially for those who would be conducting audits from the government side or from the regulator side, having a structured framework that you’re basing your usage on would be an inherently defensible way to go.

Jason Pufahl 09:07

So I’m interested, since you mentioned that StackAware went through the process, how did that process feel? Given that AI is reasonably new, I would imagine the auditors are kind of wrestling a little bit with maybe consistency or repeatability of the way they audit against this, or did it feel structured and organized and mature?

Walter Haydock 09:38

I’ve had several podcasts with my auditor and with other auditors as well. So we’ve actually, I think, had a really good discussion about this and they’ve been very transparent that things are evolving and the standards that they’re looking for, the things that are top of mind for them, are changing as the technologies change. So I think that the practice is evolving, absolutely. I don’t think we are where we potentially could be and I think most auditors would agree, which optimally an audit would take the form of a human scoping out, a series of requirements and systems and personnel, and then basically confirming that the scope is correct and then pushing a button and firing a bunch of APIs that interrogate datasets and then those send back the results and then you can confirm or deny whether you are in compliance with your requirements.

So optimally, that’s what would happen in a perfect world if everyone were perfectly coordinated and disciplined and the technology is certainly there, it’s just a matter of organization, that’s the issue. So we’re not quite there yet. I think we may get somewhere near there in the next five to 10 years.

Jason Pufahl 10:57

So for somebody that goes through the process, and I’m sure you do this pretty regularly, what are the types of things that maybe are surprises or unexpected hurdles for companies to overcome? For example, it comes to mind, I would imagine that having an AI policy is a requirement. And I think frankly, a lot of companies probably don’t have that, but that’s pretty straightforward. Are there other things that surprise your customers when they actually have to adhere to something?

Walter Haydock 11:37

A big challenge with really any compliance framework is that it cannot be grafted onto the company by the security and compliance team. That’s just really not possible to do. ISO 42001 requires the commitment of top management, which is the individual or individuals who direct the operations of the organization at the highest level. So you can’t come in and bolt on an AI management system. It does need to be built into how you do business as a company. And if you don’t have executive support, it’s going to be challenging to get all the requirements done, get the executives to participate in the operation and the readiness exercise, and maintain the management system over time. So it does require a substantial amount of effort. I think if you do it correctly, the effort will pay off. Where I think it doesn’t pay off is if you build kind of a paper compliance system or a checkbox compliance system where you’re kind of keeping two separate sets of books and we show this to the auditors but this is how we actually do business. That’s not really helping anyone. It’s kind of a waste of time. So I would advise companies to operationalize their AI management system. And that’s obviously how we advise our clients and what we do.

Jason Pufahl 13:01

Yeah. And then I think in fairness, you could say that against about almost any standard. You know, if you’re not integrating into your business practices, then it’s just something on the shelf and it doesn’t buy you anything anyway. Curious if you can prognosticate where the standard is going. Is it evolving periodically? Do you envision it maybe going the way of a SOC 2 or CMMC where it kind of grows and becomes fairly complex but then almost fundamentally requirement for certain businesses?

Walter Haydock 13:35

I definitely expect to see a growth in ISO 42001 certification as companies leverage AI as part of their products. I think the standard will need to evolve over time. ISO 27001 has gone through numerous revisions over time. The most recent in 2022. ISO 42001 came out in 2023. And I think that the structure is sound. I think there are some potential issues in terms of duplication overlap. Some of the requirements that will need a hard look when it comes up for revision. But I think the approach of taking a high level view of the requirements is something that will make it more resilient to change because it’s not highly technically dependent.

Jason Pufahl 14:26

Out of curiosity, is there a review date set for it that you’re aware of?

Walter Haydock 14:33

Not that I’m aware of, no.

Jason Pufahl 14:35

No, okay. So reasonably, I’ll put it this way, reasonably safe for somebody to actually start working on 42001 today without a lot of risk of substantive changes in the near future.

Walter Haydock 14:49

I would say so. You know, at the same time as ISO 42001 or subsequent to it, some other supporting documents came out. For example, ISO 5338 focused on AI lifecycle. ISO 23894 focused on AI risk management. ISO 42005 focused on impact assessments. So there’s been a lot of material that ISO has been putting out with respect to AI that supports the ISO 42001 standard. So there’s been a lot of material put out there.

Jason Pufahl 15:22

Okay. And you mentioned, which I think makes a lot of sense, you mentioned that it’s particularly important in regulated industries. And you mentioned a couple of those. Have you found, I guess, where have you found the, maybe the most business for you? You know, was it in the AI user space? Is it in sort of the producer space? Which companies seem most interested in this?

Walter Haydock 15:48

For us, the sweet spot for our customers are health tech companies that are rolling out AI products, either customer facing or they’re using AI on data to support their own workforces. That is a very hot and growing area. Financial technology companies also very important for similar reasons because they want to move fast. They want to be able to turn their data into value for users, but they also have regulatory requirements that they need to abide by. And then there are B2B SaaS companies that are more focused on the enterprise trust side of things. And ISO 42001 is a boon to them.

Jason Pufahl 16:35

Okay. And maybe my last question, this is something that always comes up whenever we start talking on it, which is how much effort is it potentially to go through the, you know, to get yourself in a position where you can be audited maybe from start to finish? And, you know, roughly what’s the timeframe? You know, does it take a year for a company to go through this? Can you do it more quickly?

Walter Haydock 17:04

StackAware can get customers ready for ISO 42001 in 90 days. That requires a brisk pace by customer team members and making sure that we have all the information we need, but it definitely can be done. And then I usually say that a realistic conservative timeline from zero to certification would be six or seven months. So that would be my recommendation.

Jason Pufahl 17:32

So, so honestly, that may be a little shorter than some of the other standards that are out there. I mean, you know, I’m more familiar with 27001. We do a lot of CMMC work. I mean, you know, a bunch of these things take, you know, a year, multiple sometimes. This, this sounds a little less onerous than that then.

Walter Haydock 17:53

ISO 42001 has 38 Annex 8 controls compared to, I think, 93 for ISO 27001. So it is, it is a potential lighter lift in that respect. That’s definitely something to note, especially if you already have a 27001 management system because the structure is going to be very familiar for you.

Jason Pufahl 18:12

Yeah, that, that would make sense. And usually there’s some amount of overlap with these standards as well. So, I’m glad that we bumped into each other because it, you know, certainly we do a lot of the AI, I’ll call it the AI security work, right? Data privacy, you know, some of the data labeling, things like that. Working with clients to talk about setting up their AI policies, but we haven’t really worked specifically to move somebody into 42001. And it’s not really, frankly, it’s not even coming up a lot. So I’m assuming that, you know, probably some of those regulated industries are a bit of the driver, but I would expect we’ll start to see more and more requirements just for, you know, companies are heavily utilizing it. Even if it’s a, you know, a third-party product that they’re integrating, I’m sure there are requirements built into 42001 to actually sort of oversee that process as well.

Walter Haydock 19:13

Absolutely.

Jason Pufahl 19:15

Anything as we look to wrap up that you might want to add or feel, you know, we didn’t touch on adequately today?

Walter Haydock 19:23

I think with the wave of AI regulation that has been coming out, especially in the United States, it’s important to understand how ISO 42001 fits in. So ISO 42001 is not a silver bullet by any stretch of the imagination. It gives you a system for incorporating a wide range of regulatory requirements into your management system.

Interestingly enough, though, some states like Colorado have specifically called out ISO 42001 compliance as giving you safe harbor under certain circumstances if you’re found in violation of the law. So that’s an interesting development. I think it’s unique to Colorado at this point, but it’s an interesting trend to see.

Jason Pufahl 20:08

Okay, so there’s maybe some other good reasons to start to move in that direction and let’s face it, almost every company is exploring AI, even if they aren’t sort of mature in the way that they use it. And with all of the, I guess I’ll call it hype around it, I think organizations feel a pressure to find ways to utilize AI. And so I would expect this to become a much more top of mind framework for security professionals. It doesn’t sound like it’s purely a security related framework at all. But I would guess we’d start to see this surface a lot more now.

Walter Haydock 20:52

I think so.

Jason Pufahl 20:55

Well, Walter, I appreciate you joining. I appreciate spending some time essentially a framework that I know people are gonna start paying more and more attention to. I expect we’ll probably ask you to come back at some point as we get some feedback here around complexities, challenges, who should take advantage of it. But as always, I always say, if anybody’s got questions, I’m happy to either be the central conduit and get to Walter, it’s clear enough who Walter is, so you can reach out to him. But if there’s interest, I’m happy to have a follow-up on this conversation. And hopefully people got some value out of today.

So Walter, thanks for joining.

Walter Haydock 21:35

Thank you, Jason.

Speaker 1 21:36

We’d love to hear your feedback. Feel free to get in touch at Vancord on LinkedIn, and remember, stay vigilant, stay resilient. This has been CyberSound.