Determining Your ISO 42001 Role: A Guide for Organizations

As organizations strive to manage risk and innovation in a rapidly changing AI landscape, the adoption of ISO 42001 becomes increasingly relevant.

This international standard lays out requirements for an AI Management System (AIMS) which supports consistent, risk-based governance and decision-making relating to the use of AI.

Accurately defining your AI role is a critical first step toward leveraging the ISO 42001 framework to address what matters and manage your chief AI risks.

Why Identifying Your ISO 42001 Role Matters

ISO 42001 recognizes that organizations interact with AI in diverse ways. Some develop AI systems, others deploy or operate them, and many may be both users and providers, with companies often taking on multiple roles simultaneously.

Clearly identifying your specific role(s) ensures that you fulfill the appropriate responsibilities, address relevant risks, and implement controls tailored to your context.

Common ISO 42001 Roles

While ISO 22989 (AI definitions and terms) defines 5 role categories and 10 sub-roles, most organizations fall in one of the following categories:

• AI Provider: Organizations that offer AI systems in their products and services. Note that Providers can be Platform Providers, or Product/Service Providers.
  
  Examples: AI-enabled product features, typically the integration of AI into existing products
  
  

• AI Producer: These organizations develop AI services and products, including designing, training, and modifying underlying AI models.
  
  Examples: A hospital implementing an AI-powered diagnostic tool to assist clinicians and overseeing its use in patient care.
  
  

• AI System User: End-users who interact with AI systems to achieve specific objectives. Their responsibilities often include understanding system limitations and reporting issues. In addition, the User role can describe a company’s responsible use of AI tools to support other business functions.
  
  

  Examples: A retail manager using an AI-driven inventory management platform to optimize stock levels.

EU AI Act Cross-References

The EU AI Act is principally concerned with the risk classification of AI systems rather than their specific applications, resulting in compliance requirements that are less reliant on organizational roles. Nevertheless, your designated role under the EU AI Act does entail certain responsibilities. When assessing your ISO 42001 role, it is essential to note that the EU AI Act defines roles in a manner that differs from ISO 42001.

For clarity across your organization’s compliance function, it is important to consider both ISO 42001 roles and EU AI Act roles side-by-side.

In most circumstances, a Provider under the EU AI Act will also be a Provider under ISO 42001. There is additional complexity for commercial model providers, who are considered AI Developers under ISO 42001. Note also that the EU AI Act does not distinguish between Platform Provider from Product/Service Provider, as found in ISO 42001.

The Deployer role under the EU AI Act generally corresponds to the User role under ISO 42001. However, some may also be a System Integrator or other AI Partner sub-role.

Steps to Determine Your ISO 42001 Role

1. Map Your AI Activities: List all AI-related activities within your organization—from development to deployment, operation, and use.
   
   
2. Define Interested Parties: This required activity within ISO 42001 Clause 4.1 helps bring into focus the “why” behind seeking ISO 42001 certification, and thus which AI activities are relevant to interested parties.
   
   
3. Review the Standard’s Definitions: Cross-reference your activities with the roles defined in ISO 42001 to find the best fit.
   
   
4. Engage Stakeholders: Consult with teams across your organization to ensure all AI touchpoints are considered.
   
   
5. Document Your Role(s): Clearly record your organization’s role(s) within a scope statement and your Artificial Intelligence Management System (AIMS).

Adapting to Evolving Roles

Keep in mind that roles may evolve as technology and business needs change. Regularly reviewing and updating your role is essential for sustained compliance and effective AI governance.

Conclusion

Determining your ISO 42001 role is foundational to building a robust AI management system. By understanding where your organization fits the standard, you can implement the right policies, assign responsibilities, and drive continuous improvement in your AI initiatives. 

Start with a thorough assessment, seek input from across your organization, and revisit your role as you grow and innovate with AI.

Need help understanding your role with ISO 42001 or anything else about the framework? Contact us and let our experts be your guide.