Back in 2020 we would have never thought that a semiconductor manufacturer would be almost five times as valuable as the world’s biggest retail chain. According to today’s market capitalization, the AI chip company NVIDIA has made that a reality compared to retail giant Walmart. This is reflective of the rise in AI technological advancements; think about the rise in transformer AI models in applications such as ChatGPT and autonomous vehicles. AI has become much more capable in a very short period of time. Yet, we’ve seen and reported on numerous AI incidents, many involving safety or perpetuating injustices (Rite Aid banned from using facial recognition). As such, AI has also become one of the hottest topics for regulators worldwide. The Biden Administration’s Executive Order: Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (E.O. 14110), released in late October of 2023, calls for the use of responsible AI (RAI) and harnessing AI for the betterment of society. This calls for responsible AI (RAI), which employs AI in a safe, trustworthy, and ethical manner. The 2023 AI Safety Summit in England, taking place in early November, came to a similar conclusion:
“Building trust and understanding is crucial for unlocking opportunity and addressing risk. This requires reassurance that these technologies are being used ethically and responsibly.”
Luckily, these calls did not go unanswered. In December of 2023 the ISO/IEC 42001 (Information technology – Artificial intelligence – Management system) standard was released, outlining systems for AI management and risk management. As we’ve posted, the standard advocates creating governing bodies that promote RAI and who are accountable, like an Ethics Board. The concept of AI risk management is introduced as well. However, ISO/IEC 42001 stays at a high level for organizations that develop, provide or use AI systems. Most importantly, it doesn’t specify the technical processes of an AI system lifecycle, as it mainly only referencing ISO/IEC 22989 (Artificial intelligence concepts and terminology). If ISO/IEC 42001 doesn’t provide specific AI lifecycle guidance, what steps are involved in implementing RAI?
ISO/IEC 5338, published in December of 2023, was introduced to address this gap. Like ISO/IEC 42001, the scope of the standard is agnostic to industry, product, service, or even the size of an organization. It provides the technical details of AI system life cycle processes and breaks those down into subprocesses. The standard is based on processes from ISO/IEC/IEEE 15288 (System life cycle processes) and ISO/IEC/IEEE 12207 (System life cycle processes), a revised version of ISO/IEC/IEEE 15288. The standard introduces three types of processes:
- Generic processes – processes identical to those in ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207
- Modified processes – processes with modifications made to those in ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207
- AI-specific processes – processes that are entirely unique to AI systems and are not based directly on processes in ISO/IEC/IEEE 15288 and ISO/IEC/IEEE 12207
AI-specific processes include an AI data engineering process and a continuous validation process for deployed models. For example, in the AI data engineering process emphasis is placed on reducing bias, avoiding generalizations, and preventing malicious actors from taking advantage of data.
Modified processes have added AI-specific particularities and modified elements. For example, in the implementation process (creating an item from requirements, architecture, and design), activities and insights on algorithm selection, model training, and knowledge programming are included. AI-specific particularities for the implementation process include optimizations to speed up the development process, e.g. transfer learning, AutoML, and involving AI work in a backlog.
All of these technical processes from IEC/ISO 5338, along with the AI management system from ISO/IEC 42001, go toward answering how RAI is implemented on an organizational, management, and engineering level. At SRES we work with clients to properly establish their AI management system and technical processes.
