Book a time

Frameworks in Practice

There is no checklist

Peter O'Hanlon, founder of Koncura

Frameworks in Practice: all 12 articles

Thesis

ISO 42001 starts with context. The organisation’s context and its stakeholders’ expectations flow down into the risk assessment, the impact assessment and every control choice after them. A checklist of safety controls detached from that context makes no sense. Two opposite mistakes follow from forgetting this, and readiness sits between them. Getting it right-sized for your ambitions and your risks takes skill, not a generic checklist.

Reader

A founder, CTO or NfP CEO who has been offered a policy pack, a readiness template, a compliance automation tool, or a list of technical controls that promises ISO 42001 out of the box.

Opening

Two organisations, both sure they are ready. One has a strong set of technical controls: logging, access, model testing, guardrails. The other has a full set of documents: policy, scope, risk register, Statement of Applicability. Neither can answer the first question an auditor will ask, which is why these controls and these documents, for this organisation?

Beats

  1. Context comes first. Clause 4.1 (issues and the organisation’s role with respect to its AI systems), 4.2 (interested parties and their expectations) and 4.3 (scope) flow down into 6.1.2 (risk), 6.1.4 (impact assessment) and the Statement of Applicability. Context is the golden thread.
  2. Mistake one: false self-assurance from technical controls. A control list feels like safety, but a control only means something against the risk it was chosen for. Without the context you can’t say whether the controls are the right ones, or enough.
  3. Mistake two: documents as readiness. A full document set feels like compliance, but documents describe a system; they don’t prove it runs. The question is whether the controls are sensible and working.
  4. They work hand in hand. Context explains the documents, the documents explain the controls, and the controls produce the evidence that the documents are true.
  5. Right-sized is a skill. The same standard asks different things of a five-person startup and a bank, set by your ambitions (who you sell to, what you want to be trusted with) and your risks (who your AI touches). A generic checklist can’t size itself. A questionnaire can prompt the analysis but can’t do it. You can’t automate what you haven’t done.
  6. Why this favours small organisations. Context analysis takes thinking, not headcount. The big end of town buys machinery; a founder who knows the business can do the thinking, and the thinking is what the standard asks for.
  7. The ladder (adopting, governing, proving, ready), briefly.

Key lines

  • Controls without context are a false sense of safety. Documents without working controls are a false sense of readiness.
  • Right-sized for your ambitions and your risks.
  • You can’t automate what you haven’t done.

What you can do on Monday

Write one page: what your AI does, for whom, who would care if it went wrong, and what you want to be trusted with next. Then check whether your controls and your documents both trace back to that page.

Series index page; BigDocs piece 8 (evidence that controls work); offers page.