How do I perform the AI risk assessment required by ISO/IEC 42001 Clause 6.1.2?

To perform the AI risk assessment required by ISO/IEC 42001 Clause 6.1.2, an organization must establish a process for identifying and addressing risks and opportunities related to AI systems. This involves understanding the context of the AI Management System (AIMS) and identifying potential impacts of AI systems.

Here are concrete controls for performing an AI risk assessment:

• Define the AIMS Context: Determine the internal and external context, interested parties, and the scope of the AI Management System. This aligns with the NIST AI RMF's MAP function, which focuses on identifying and inventorying the AI system and its context.
• Establish an AI Policy and Leadership: Top management must demonstrate leadership by having an AI policy, a documented AIMS, and assigned roles, responsibilities, and authorities for AI governance. This cross-maps to NIST-GOVERN-1.1 and NIST-GOVERN-2.1, which emphasize legal and policy requirements and defined roles and responsibilities for AI risk.
• Identify AI System Impacts: Implement processes to assess the impacts of AI systems on individuals, groups, and society across their lifecycle. This directly corresponds to the NIST AI RMF's MAP-5.1 control, which focuses on identifying potential positive and negative impacts.
• Inventory AI Systems: Maintain a current inventory of AI/agent systems, including models, agents, tools, and data flows. This is a foundational step for risk assessment, aligning with NIST-MAP-1.5.
• Consider Third-Party Risks: Address risks associated with suppliers and third parties in the AI value chain, such as model providers, data providers, and tool/plugin vendors. This cross-maps to NIST-GOVERN-6.1 and OWASP LLM03 (supply chain).
• Implement Operational Controls: Ensure that the AI risk and impact assessments are implemented, and AI systems are operated under defined controls. This falls under the MANAGE function of the NIST AI RMF, which involves prioritizing, responding to, and monitoring risks over time.