ISO/IEC 42001 was published at the end of 2023 and is the first certifiable standard for managing artificial intelligence. The author sat on the team that drafted it, and the book delivers what it promises: how each clause is to be read, how to set up an internal audit programme, how it connects with European regulation. It is a compliance book, not a technology book: there is not a line of code in it.
What I took from it
The idea I use most is that this is a management system, not a technical control. The question that organises everything is not which model is running but who decided to use it, on what grounds, who reviews the output, and who answers when the output is wrong. That chain, written on one page, is what most AI projects I have seen from the inside are missing.
The second is the impact assessment on affected people, which the standard keeps separate from organisational risk assessment. The risk of the company looking bad and the risk of someone being denied something by an automated decision are not the same thing. Telling them apart changes the design, not just the paperwork.
And the third: what you write down about a system — which data it uses, what it was built for, where it must not be used — is useful even if nobody ever gets certified. Half an hour of writing stops the system ending up doing something it was never meant to do.
What I left out
The entire certification process. A mid-sized company in Ecuador is not going to hire an accredited body to audit its invoicing assistant, and pretending otherwise would be selling smoke. I also leave out the survey of US and European regulation: it moves fast and it does not apply here. Read with those scissors, the book yields around forty useful pages. You have to know which forty before you start.