I implemented an ISO 42001-certified AI Governance program in 6 months

Thanks a ton for posting this ! I have been looking for just such material on implementing AI Governance (at a non profit, if that matters). The whole literature and research listed there is super helpful to me.

Thanks Beatrice

Re: I implemented an ISO 42001-certified AI Governance program in 6 months

#7

Post by simonjgreen » Sat, Nov 15, 2025, 7:25 PM UTC

aleks5678 wrote: post #2

Who audits compliance?

An internal audit is how you go from gap assessment to ready for external audit.

External auditors should be selected by looking for ones who themselves are audited by your regional government auditing body. Eg if you wanted to be audited and certified for ISO27001, and you happened to be in UK, you may choose BSI as your external auditor, who themselves are audited by UKAS.

It’s a web of trust model.

The purpose of these certificates are to shortcut compliance checks by your customers (or in some cases suppliers).

Re: I implemented an ISO 42001-certified AI Governance program in 6 months

#8

Post by Alex2037 » Sat, Nov 15, 2025, 7:31 PM UTC

>Or can we follow the decades of experiences built when developing new technologies like planes, trains, and automobiles? Indeed, we can.

do we regulate any software the way we regulate planes?

operating systems? compilers? web browsers? text/image/video/audio/3D editors? video games?

Re: I implemented an ISO 42001-certified AI Governance program in 6 months

#9

Post by markerz » Sat, Nov 15, 2025, 7:35 PM UTC

Alex2037 wrote: post #8

>Or can we follow the decades of experiences built when developing new technologies like planes, trains, and automobiles? Indeed, we can. do we regulate any software the way we regulate planes? operating systems? compilers? web browsers? text/image/video/audio/3D editors? video games?

Health care software with HIPPA compliance? Or SOC2? It’s not the same but it’s a high degree of regulation.

Re: I implemented an ISO 42001-certified AI Governance program in 6 months

#10

Post by reed1234 » Sat, Nov 15, 2025, 7:37 PM UTC

Alex2037 wrote: post #8

>Or can we follow the decades of experiences built when developing new technologies like planes, trains, and automobiles? Indeed, we can. do we regulate any software the way we regulate planes? operating systems? compilers? web browsers? text/image/video/audio/3D editors? video games?

I feel like for software it depends on the use case, not the technology. There a plenty of laws about software use cases such as data storage and privacy compliance etc.