Módulo 6: Industry Standards and Frameworks
ISO 42001: AI Management System
Descripción
ISO/IEC 42001 (publicado Diciembre 2023) es el primer standard internacional certifiable para AI Management Systems. Es la "ISO 27001 para AI": estructura tu organización con procesos formales para AI governance.
Para startups, ISO 42001 es likely overkill Day 1. Pero important to know porque:
- Enterprise clients lo pedirán en RFPs
- Es certifiable (third-party audit valida tu cumplimiento)
- Cambia el valor de tu compañía (certified company = more trustworthy)
Al terminar vas a poder:
- Entender la estructura de ISO 42001
- Identificar cuándo certification es valuable
- Decidir si implementás pre-certification (best practices sin auditor)
- Mapear tu sistema a ISO 42001 controls
Qué es ISO 42001
ISO 42001 sigue la estructura típica de management system standards (similar a ISO 9001 quality, ISO 27001 security):
Clauses 4-10: management system requirements
- Clause 4: Context (entender tu organization y stakeholders)
- Clause 5: Leadership (commitment del management)
- Clause 6: Planning (objectives, addressing risks)
- Clause 7: Support (resources, awareness, documentation)
- Clause 8: Operation (operational planning, risk treatment)
- Clause 9: Performance evaluation (monitoring, audit)
- Clause 10: Improvement (corrective actions, continual improvement)
Annex A: AI controls
Lista específica de controls para AI, organizado en categorías:
- AI policies
- AI risk assessment
- Privacy and data protection
- Information security
- Reliability and resilience
- Transparency and explainability
- Fairness and non-discrimination
- Human oversight
- AI lifecycle management
Each control must be implemented or excluded with justification.
ISO 42001 vs NIST AI RMF
| Aspect | ISO 42001 | NIST AI RMF |
|---|---|---|
| Certifiable | ✅ Yes | ❌ No (voluntary framework) |
| Cost | $$$$ (audits, fees) | Free |
| Adoption | Growing in enterprise | Wider adoption tech |
| Detail | Specific controls (Annex A) | Functional framework |
| Geographic | International | US-origin, global use |
| Maturity | Early stage (2024+) | Established |
They complement: ISO is the certifiable wrapper, NIST is the practical framework you use day-to-day.
Cuándo ISO 42001 es valuable
Definitivamente sí
- Client enterprise (Fortune 500) requires it in RFP
- You're in regulated sector (finance, healthcare) where customers expect cert
- You compete against larger players who have it
- M&A: certification raises valuation
Probably no
- Early startup pre-PMF
- 5-10 person team
- B2C consumer product
- Customers don't ask for it
Approach intermedio: pre-certification
Implementás los principios sin certifying officialmente. Si cliente pregunta later, podés mostrar:
- "We follow ISO 42001 best practices"
- Documentation aligned to clauses
- Internal audits but no external
Cuesta significantly less, value real (preparedness for future cert).
Implementación: mapping tu sistema a ISO 42001
Clause 4: Context
## 4.1 Understanding the organization
[Brief description: B2B SaaS AI assistant, 50 clients, 50K users]
## 4.2 Stakeholders
[Internal: team, board. External: clients, end users, regulators, providers]
## 4.3 Scope of AI Management System
[Specifies: AI components, geographies, exclusions]Clause 5: Leadership
## 5.1 Leadership commitment
[CEO signs commitment to AI ethics; allocates resources]
## 5.2 AI policy
[Link to AI Use Policy from M6-02]
## 5.3 Roles, responsibilities, authority
[Link to accountability matrix from M6-02]Clause 6: Planning
## 6.1 Risks and opportunities
[Risk Register from M6-05]
## 6.2 AI objectives
[Quantifiable: <5% hallucination rate, P95 latency <8s, 0 breaches]Clause 7: Support
## 7.1 Resources [budget]
## 7.2 Competence [team training]
## 7.3 Awareness [policies communicated]
## 7.4 Communication [internal/external]
## 7.5 Documented information [this document + RoPA + DPIA + etc.]Clause 8: Operation
## 8.1 Operational planning
[Sprint planning, change management]
## 8.2 AI risk assessment
[Process from Map function NIST]
## 8.3 AI risk treatment
[Process from Manage function NIST + risk register]Clause 9: Performance Evaluation
## 9.1 Monitoring
[From Measure function NIST]
## 9.2 Internal audit
[Annual schedule, ethics audit (M8) plays this role]
## 9.3 Management review
[Quarterly governance review]Clause 10: Improvement
## 10.1 Continual improvement
[Post-incident reviews, lessons learned database]
## 10.2 Nonconformity and corrective action
[Incident response process + remediation tracking]Annex A controls
Para each control, documentás:
- Status: Implemented / Partially / Not Applicable / Planned
- Evidence: link to where shown
- Owner
Certification process
Si vas por certification:
Phase 1: Gap analysis (1-3 months)
- Internal review of current state vs ISO requirements
- Identify gaps
- Plan remediation
Phase 2: Implementation (3-12 months)
- Address gaps
- Document policies and procedures
- Train team
- Operate the system for 3-6 months
Phase 3: Internal audit (1 month)
- Conduct internal audit
- Address findings
- Prepare for external
Phase 4: Stage 1 audit (external)
- Auditor reviews documentation
- Identifies major gaps
- Plan to address
Phase 5: Stage 2 audit (external)
- Auditor on-site (or remote) verifying
- Issue certificate if pass
Phase 6: Surveillance audits (annual)
- Auditor returns annually
- 3-year recert cycle
Cost: $20K-$100K+ depending on company size and auditor. Time: 6-18 months from start to certificate.
Pre-certification value (alternative)
Without paying for cert:
- Document everything per ISO 42001 structure
- Run internal audits annually
- Train team
- When client asks: "We follow ISO 42001 best practices; can provide documentation"
Cost: time only. Benefit: real governance + preparedness if future cert needed.
Trampas comunes
Trampa 1 — Certifying too early. Spend $50K cert, then pivot product. Wasted. Wait for traction + revenue + client demand.
Trampa 2 — Certification as panacea. Cert ≠ ethical AI. Cert ≠ legal compliance. Cert is evidence of process, not perfection.
Trampa 3 — Documenting for certification, not for use. Beautiful documents nobody reads. Documentation should serve operations first, cert second.
Trampa 4 — Skipping pre-cert. Want to certify but skip the documentation discipline. Cert audit fails — auditor sees mess.
Ejercicio
Para tu Capstone:
- ¿ISO 42001 cert es relevant ahora? Justify yes/no
- Map your existing path deliverables a ISO 42001 clauses (which clauses are auto-covered?)
- Identifica 3-5 gaps típicos para startup pre-cert
- Decisión: implementás pre-cert ahora o esperás?
Ver solución
-
Relevance: typically NOT now if pre-PMF startup. YES if:
- Have ≥10 enterprise clients
- Industry: finance, healthcare, government
- Client RFPs starting to ask
-
Auto-covered by path deliverables:
- Clause 5.2 (AI policy): ✅ via M6-02 governance
- Clause 6.1 (risks): ✅ via M6 NIST mapping
- Clause 8.2 (risk assessment): ✅ via M6
- Clause 9.1 (monitoring): ✅ via M6 Measure
- Annex A bias: ✅ via M2 bias toolkit
- Annex A privacy: ✅ via M3 + M5 GDPR
- Annex A transparency: ✅ via citation + explainability
-
Typical gaps:
- Clause 5.1 formal leadership commitment (often informal)
- Clause 7.2 systematic competence training
- Clause 9.2 formal internal audit cycle
- Clause 10.2 formal corrective action process
- Annex A: human oversight controls
-
Decision tree:
- Have enterprise demand? → Plan cert for 6-12 month timeline
- No specific demand, but anticipate? → Implement pre-cert (3-6 months docs work)
- Bootstrapped, no demand? → Skip for now, revisit yearly
Resumen
Aprendiste:
- ✅ ISO 42001 structure: Clauses 4-10 + Annex A
- ✅ Comparison con NIST AI RMF
- ✅ Cuándo certification es valuable
- ✅ Pre-certification approach (best practices sin auditor)
- ✅ Implementation: mapping to clauses
- ✅ Cost y timeline de cert
Checkpoint: si sabés cuándo ISO 42001 cert sería valioso y cómo mapear tu sistema, suficiente.
Siguiente cápsula
08 — Proyecto: Standards Mapping. Aplicás NIST AI RMF (principalmente) y ISO 42001 (mapping conceptual) a tu sistema concreto.
Recursos
- ISO/IEC 42001 official.
- BSI Group — ISO 42001 guide — implementation help.
- AI Verify Foundation — Singapore-origin AI testing.
- Comparison: NIST vs ISO.