Leadership and commitment

ISO 31000:2018, 5.2 applies. The artefact behind the answer is published statement of commitment to AI risk management. Test it on the 5.2 question at the next framework review.

What it asks

ISO 31000:2018, 5.2 applies. Since trust and accountability weigh heavily in building and using AI, top management ought to think about how the organization's policies and statements on AI risk and its handling are put across to stakeholders; visible leadership can decide whether stakeholders believe AI is being built and used responsibly, so issuing a statement of commitment to AI risk management is worth considering. Top management also needs to recognize that AI risk work may call for specialist resources and provide them.

Where generative AI changes the answer

When business units buy generative AI directly, a visible statement from the top is the only thing that tells staff which uses are permitted.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.2 the named role is the owner of published statement of commitment to AI risk management.

Evidence an auditor normally samples

• Published statement of commitment to AI risk management
• Evidence of top management allocating specialized AI risk resources

The test you can run

Take published statement of commitment to AI risk management and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Commitment to responsible AI asserted in marketing with no policy behind it
• AI risk management staffed from the general risk function with no AI expertise

Before the draft publishes

For 5.2, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is published statement of commitment to AI risk management.

Where this sits against the draft

5.2 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.2 (leadership and commitment) with this record and note the change in the register.