Week 12 self-check | AI GRCA Practice Lab

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

Which of these questions is best answered using ISO/IEC 42005 rather than 42001?

'How do we handle nonconformities under Clause 10?''Who has authority to approve our AI policy?''What adverse effects could this system have on tenants with limited English proficiency?''What does our internal audit programme look like?'

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

How does ISO/IEC 42005 relate to NIST AI RMF's MAP function?

MAP is a certifiable standard like 42005They are unrelatedBoth involve understanding context and impacts on affected people, though structured differently42005 replaces MAP entirely

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

What does 'AI actor' terminology, as covered under 22989-style vocabulary, help clarify?

Only who owns the intellectual propertyOnly the identity of the end customerNothing useful for governanceWho is responsible at each stage — developer, provider, deployer, user, affected person — reducing accountability confusion

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

What is a 'management system' in the ISO sense, as distinct from a single policy document?

A structured, repeatable set of interrelated processes an organisation uses to achieve objectives and manage risk, including planning, operation, evaluation and improvementOnly the software used to track complianceA one-time audit checklistA synonym for a policy

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

Why do ISO AI standards matter to a practitioner, beyond academic interest?

They give a shared vocabulary, a governance-system structure and an impact-assessment method that make AI governance consistent and auditableThey are only relevant to software engineersThey replace the need for any legal analysisThey have no practical use

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

Why does 'how ISO 42001 supports governance system design' matter for a multi-site organisation?

It doesn't — every site should govern independently with no shared structureIt provides a common structure so different sites or business units can be governed consistently rather than ad hocIt only applies to single-site organisationsIt replaces the need for site-level ownership

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

A company documents its AIMS scope, policy and objectives but has never run an impact assessment on any deployed system. Which standard's practice is missing?

None — impact assessment isn't part of any of these standardsISO/IEC 22989ISO/IEC 42001ISO/IEC 42005

WEEK 12 · ISO AI management · ISO AI Standards: ISO/IEC 22989, ISO/IEC 42001 and ISO/IEC 42005

How do the three standards relate to each other?

They are unrelated22989 gives shared terminology, 42001 is the management-system structure, 42005 gives impact-assessment guidance within it42005 replaces the other two42001 is only a glossary