Governing AI at Scale with ISO 42001

Interview with Hiral Shah | Chief Information Security Officer at a global manufacturing firm | 20+ years in software, cybersecurity and compliance across fintech and manufacturing

Published: August 11, 2025 · Updated to use the standard's full name, clarify its scope and reflect the EU AI Act timeline as amended in 2026.

CISOs used to protect systems. Now they are expected to protect decisions. Hiral Shah, who leads AI risk governance as a CISO in manufacturing, sees ISO/IEC 42001:2023, the first certifiable international standard for AI management systems, as the most practical way to turn that new mandate into a working process.

What ISO/IEC 42001 Is, and What It Is Not

ISO/IEC 42001 was published by ISO and IEC in December 2023. It is a management system standard, in the same family as ISO/IEC 27001 for information security, and organizations can be certified against it.

It requires an organization to:

• Define an AI policy, objectives and clear roles
• Assess AI risks and carry out AI system impact assessments
• Apply a set of reference controls, listed in its Annex A, covering areas such as data for AI systems, the AI system lifecycle and third-party relationships
• Monitor, audit and continually improve the system

It does not prescribe specific technical tests for bias or model drift; each organization decides how to meet each control. It also sits alongside other frameworks rather than replacing them. ISO/IEC 23894 gives guidance on AI risk management, and the U.S. NIST AI Risk Management Framework (AI RMF 1.0) offers a voluntary, non-certifiable approach organized around four functions: Govern, Map, Measure and Manage.

The CISO's Job Now Includes the Model

AI governance is a board-level issue, and the CISO role is expanding with it. "CISOs are no longer just protecting systems," Shah says. "We're protecting decisions, outcomes, and the integrity of the models themselves."

That is why he puts impact assessment at the center. "In an AI management system, impact assessment plays the most important role," he explains. "It's not just about identifying risks, it's about understanding how those risks affect people and outcomes."

Traditional standards like ISO/IEC 27001 and SOC 2 remain useful, but they were not built for algorithmic bias, model drift or systems that keep learning. ISO/IEC 42001 brings those risks into a structured, auditable process.

Start With a Gap Assessment

ISO/IEC 42001 is not about reinventing governance. It is about extending it to AI. Shah recommends starting with a gap assessment that compares current policies and controls with the standard, then:

• Updating policies to cover AI use and development
• Training employees, the step most often skipped. "Many organizations misunderstand what AI governance actually requires."
• Expanding monitoring to cover models, data and suppliers

The supply chain matters as much as the model. Most AI systems depend on third-party cloud infrastructure, external data sources and pre-trained components. "You can't govern AI without governing its ecosystem," Shah says. "Everything, from infrastructure to data, has to be secure and verifiable." Data quality is often the weakest link. "A lot of organizations have data, but the quality and classification of that data is often a question mark."

Trust Comes From Visibility

Shah describes three practices that make trust in AI measurable:

1. Frequent audits, especially after major updates or changes in training data, to catch drift and errors early.
2. Stakeholder feedback to surface misalignment. "Are the results aligned? Is the AI actually ethical in its decisions?"
3. Visibility into decision-making, so teams can explain what the model did. "We need to know what the model is doing and why, and be ready to course correct when needed."

Same Standard, Different Priorities

Shah's work across fintech and manufacturing shows how context changes the application. "In fintech, it's all about privacy and security, starting from KYC to managing customer data," he explains. "In manufacturing, the focus shifts to operational safety and system reliability." The foundation does not change. "Whether it's fintech or manufacturing, the foundation is still risk management, but how you apply it needs to match the context."

Don't Wait for the Regulator

In Shah's view, no other standard currently brings security, ethics and lifecycle management together as broadly as ISO/IEC 42001, and early adoption is a strategic move rather than a defensive one. "Don't wait for regulators. The earlier you adopt this, the more control you have over how AI is integrated into your organization."

The regulatory calendar is filling in. In the EU, the AI Act entered into force in August 2024. Obligations for general-purpose AI models have applied since August 2025, while the 2026 amendments known as the AI Omnibus moved the main obligations for stand-alone high-risk AI systems to December 2, 2027, and for high-risk AI embedded in regulated products to August 2, 2028. ISO/IEC 42001 certification does not by itself demonstrate compliance with the AI Act, but it gives organizations a governance structure they can map to its requirements.

Key Takeaways From Shah

• ISO/IEC 42001:2023 is the first certifiable international standard for AI management systems, giving organizations a structure for fairness, transparency and accountability.
• CISOs are moving from system defenders to stewards of how AI is built and trusted.
• Trust requires more than certification: audits, stakeholder feedback and decision traceability.
• The standard should be applied to each sector's priorities, whether privacy or operational safety.
• Shah sees early adoption as an advantage before mandates arrive.

Hiral Shah is a cybersecurity and compliance leader with more than two decades of experience across programming, cybersecurity and AI risk governance, including work in fintech. He currently serves as Chief Information Security Officer at a global manufacturing firm, where he leads AI risk governance.

Sources

• ISO/IEC 42001:2023, Artificial intelligence: Management system
• NIST AI Risk Management Framework (AI RMF 1.0)
• EU AI Act, Regulation (EU) 2024/1689
• AI Omnibus timeline: K&L Gates via Mondaq and Addleshaw Goddard

Related on the Community Hub

• The Market for AI Governance and ISO 42001 Adoption
• Governing Humanoids in Healthcare and Education
• Reframing Cybersecurity in Private Equity Transactions

‍