This week I had the pleasure of attending a masterclass by Juan Manuel Belloto Gómez on responsible AI and the implementation of ISO/IEC 42001.
The course, run through AENOR, covered everything from the ethical principles of AI and the regulation governing its use —the EU AI Act— through to ISO/IEC 42001, EN 18286 and ISO/IEC 23894, among other standards.
Over these days I was able to go deeper into aspects that don't always appear in the standards or the laws themselves. Together, we built a more harmonised view of what's actually required of an AI system that is responsible, robust and trustworthy.
The notes I'm taking away
Here are the points that matter most to me:
ISO 42001 carries no presumption of conformity with the EU AI Act: complying with ISO 42001 does not guarantee compliance with the regulation.
The first and, as of today, only harmonised standard for complying with Article 17 of the AI Act is EN 18286, which allows you to build a Quality Management System (QMS).
Although standards such as ISO/IEC 23894 and the NIST AI RMF exist, AI risk management can also be adapted using your own methodology or other risk management standards you already have in place, such as ISO/IEC 27005 or ISO 31000.
What's next: the Lead Auditor certification
This training is undoubtedly key, given how much is currently changing in AI regulation.
Now, on to the next step: the Lead Auditor certification for ISO/IEC 42001.
Toni
This is a courtesy translation of the Spanish original. I help companies fit AI into their compliance obligations, from the AI policy to the real relationship between ISO/IEC 42001 and the EU AI Act. If that's where you are, let's talk.