Boards are being asked about artificial intelligence well before most organisations have any structured way to answer. ISO/IEC 42001 — the AI management system standard — is the first widely applicable answer to “how would we demonstrate this is under control?”
It is a management system, not a technology control set
Anyone who has been through ISO/IEC 27001 will recognise the shape immediately: context, leadership, planning, support, operation, evaluation, improvement. What changes is the subject matter — the impact of AI systems on the people affected by them, not only on the organisation deploying them.
The questions a director can ask
- Do we have an inventory of the AI systems in use, including the ones inside purchased products?
- Who is accountable for each one — by name, not by function?
- What happens when a model is wrong, and who finds out?
- What data went in, on what basis, and could we evidence that to a regulator?
- Which decisions are we willing to let a system make without a human in the path?
None of these require a technical background to ask. They require somebody at the table willing to keep asking until the answer stops being a slide.