Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / ISO 42001 with Walter Haydock and Punit Bhatia in the FIT4PRIVACY Podcast E158 S07

Transcript

ISO 42001 with Walter Haydock and Punit Bhatia in the FIT4PRIVACY Podcast E158 S07 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  ISO 42,001 artificial intelligence management system.
• 0:05
  What is it about? Why should you get certified in
• 0:07
  it, and is it relevant in the field of AI?
• 0:11
  What are the AI risks for healthcare companies?
• 0:15
  How can these be mitigated? What's happening with the state
• 0:18
  of regulation? And how does ISO 42,001 help
• 0:22
  manage you and your company in a way that you can comply with
• 0:27
  regulations and demonstrate responsible AI?
• 0:30
  And also, why should you and your staff get certified in ISO
• 0:35
  42,001? Well, these are all relevant
• 0:38
  questions. This is why we have Grow Skill
• 0:41
  Store wherein we help you with ISO trainings.
• 0:44
  And This is why we have a very special guest today, Walter
• 0:49
  Haydock, who's going to talk to us about the AI risks, the
• 0:53
  evolving regulatory landscape and the relevance of ISO 42,001
• 0:58
  artificial intelligence management system.
• 1:01
  Let's go and talk to him. And as you do that, do take
• 1:05
  advantage of Growskills dot store, ISO 42,001 and other
• 1:10
  courses. Welcome to the Fit for Privacy
• 1:14
  Podcast where your host Puneet Bhatia discusses the latest
• 1:17
  trends, challenges and opportunities in privacy,
• 1:20
  artificial intelligence, sourcing and related fields with
• 1:23
  industry leaders and experts. Whether you're a professional
• 1:26
  business leader or just passionate about topics like AI
• 1:29
  and privacy, this is your go to place for insightful
• 1:32
  conversations and practical advice.
• 1:34
  The Fit for Privacy podcast is brought to you by Fit for
• 1:37
  Privacy, your trusted partner in AI privacy and sourcing matters
• 1:41
  and gross skill store. Your go to destination for top
• 1:44
  tier training on ISO standards and key EU regulations.
• 1:48
  Remember that opinions expressed in this podcast are not legal
• 1:50
  advice. Now it's time to dive in today's
• 1:53
  episode. Hello, and welcome to the Fit
• 1:58
  for Privacy podcast. Another episode and today we
• 2:01
  have Walter Haydock. Walter, welcome to the Fit for
• 2:03
  Privacy podcast. Thank you for having me on.
• 2:07
  It's a pleasure and let me start with a very basic question.
• 2:11
  We all talk about artificial intelligence, but we all define
• 2:14
  it differently. How would you put AI in your
• 2:18
  words? To me, artificial intelligence
• 2:21
  is any approach that provides an output that doesn't rely on
• 2:28
  rules to generate that outcome. So if you are adding 2 + 2, you
• 2:33
  know every time that will equal 4.
• 2:35
  You follow a strict set of rules to arrive at that outcome.
• 2:39
  But if you are not following that approach, if there is any
• 2:44
  variability in the outputs, if it's non deterministic, than
• 2:47
  that is artificial intelligence. Now, it's important from a
• 2:50
  compliance perspective to look at the jurisdiction or
• 2:54
  jurisdictions that you're operating in, because each one
• 2:57
  is defining AI differently and many have subordinate terms that
• 3:02
  are encompassed by AI. And each has its own
• 3:06
  requirements and ways in which you should handle those systems
• 3:11
  according to those laws. It's very well put and in this
• 3:17
  AI world, lot of healthcare companies are relying on AI to
• 3:22
  provide innovative products and as they provide products, we
• 3:27
  have some risks which are being introduced especially in this AI
• 3:30
  powered environment. What kind of risks are
• 3:33
  specifically significant security risks that you see in
• 3:37
  this environment for healthcare companies?
• 3:40
  Healthcare companies are in what I consider to be the highest
• 3:44
  risk, but also highest reward industry when it comes to
• 3:48
  deploying artificial intelligence.
• 3:50
  And the primary security risk that I see is data leakage.
• 3:55
  So when you are using artificial intelligence for healthcare
• 3:59
  purposes, you're handling, by its definition, very sensitive
• 4:02
  data. So it's important to make sure
• 4:04
  that the model that's processing that information isn't training
• 4:08
  on it in a way you didn't expect, that the information is
• 4:13
  not being retained for longer than you need from a business or
• 4:17
  a regulatory perspective. And then also that those who
• 4:22
  have a need to know are the only people that are able to access
• 4:26
  that data. So data leakage, from my
• 4:28
  perspective, is the biggest risk when it comes to using AI in
• 4:31
  healthcare, but it is not the only one.
• 4:35
  And any other risk that comes to your mind apart from data
• 4:38
  leakage? An incredibly important risk
• 4:43
  from a healthcare perspective when you're talking about AI is
• 4:47
  the integrity of the outputs. Because people will use AI
• 4:54
  powered products to help find care to determine what the best
• 5:00
  course of action for treatment is, whether doctors are using it
• 5:04
  to record conversations with patients and transcribe those
• 5:08
  conversations. There is a lot on the line when
• 5:11
  it comes to the accuracy of the outputs of AI systems.
• 5:15
  So making sure that they faithful faithfully reproduce
• 5:20
  the data which they're transcribing or that they
• 5:23
  provide effective information to the user is another key concern.
• 5:28
  Absolutely. And OK, it's good to know the
• 5:32
  risks, but are there any practical measures, simple
• 5:35
  measures that companies can take to manage these risks?
• 5:40
  In terms of managing the data confidentiality risks with
• 5:45
  respect to healthcare use cases, there are a variety of concrete
• 5:50
  steps that companies can take. So first of all, in the US, if
• 5:55
  you are processing protected health information and you're
• 5:58
  using a third party to do it, you need to have what's called a
• 6:01
  business associate agreement in place that lays out the terms of
• 6:05
  your engagement with that third party.
• 6:09
  So that's a great opportunity to make sure you have the
• 6:12
  appropriate controls in place. There are increasingly, I would
• 6:17
  say, aggressive rules that are cropping up all across the US
• 6:21
  and the world when it comes to you processing health
• 6:23
  information. We're seeing data localization
• 6:25
  requirements, we're seeing prohibitions on training on even
• 6:31
  the identified data. So making sure that you
• 6:33
  understand the compliance landscape when it comes to how
• 6:37
  you're treating data is important.
• 6:39
  And then also from a technical perspective, applying due
• 6:42
  diligence to your vendors, making sure that they are
• 6:46
  applying, you know, security patches, they have vulnerability
• 6:49
  management programmes, that they have effective security
• 6:52
  operations programmes. Those are all key steps that
• 6:55
  companies can take to safeguard healthcare data.
• 6:58
  Absolutely. And you mentioned about rules
• 7:02
  and rules are typically driven by regulations and we see a lot
• 7:07
  of regulation that's happening in AI.
• 7:10
  We see a lot of regulation that happened in last 10 years in
• 7:13
  privacy and security and cybersecurity.
• 7:16
  So how do you see or what do you see as the regulatory landscape
• 7:20
  for AI powered companies very specifically?
• 7:24
  As far as the AI regulatory landscape goes, we're seeing a
• 7:27
  pretty big divide between Europe and the United States.
• 7:31
  Europe, as you well know, is rolling out the EUAI Act as we
• 7:37
  speak. It's in partially it being
• 7:41
  enforced right now. Not all of the requirements are
• 7:43
  in force in the United States. You're seeing a different
• 7:46
  approach where at the federal level there's quite little
• 7:49
  regulation. And in fact, there was a
• 7:52
  proposal to ban state level regulation of AI for 10 years
• 7:56
  that did not pass. And as a result, we're seeing
• 8:00
  the individual U.S. States and even jurisdictions
• 8:03
  like New York City pass their own rules when it comes to
• 8:06
  artificial intelligence. So that's going to make it more
• 8:09
  difficult for businesses to comply with these requirements,
• 8:12
  while at the same time allowing for more tailored regulation
• 8:15
  based on the the attitude, the culture, the the business
• 8:18
  friendliness of the state that is enacting the rules.
• 8:22
  That's very well said. Now the question is, with every
• 8:26
  state coming up with its own regulation, legislation and
• 8:30
  sometimes rules, sometimes executive orders, how can a
• 8:34
  company adapt or follow this situation because it's not
• 8:38
  practical to do a new compliance programme every week.
• 8:43
  To deal with the array of new regulations that are being
• 8:47
  passed across the world when it comes to AI, what I recommend
• 8:51
  doing is using the ISO 42,001 standard as a blueprint for
• 8:56
  building an AI management system.
• 8:59
  The first operational clause of that standard requires taking
• 9:02
  into account internal and external issues.
• 9:05
  External issues being things like laws, regulations, guidance
• 9:09
  from government authorities on the use of AI.
• 9:12
  And once you build a framework, a process for taking into
• 9:17
  account these types of requirements, you can more
• 9:20
  effectively comply with them across the board.
• 9:23
  And you may decide to do things like setting a, a, a, a floor on
• 9:28
  how you're using AI to make sure that you comply with all
• 9:30
  applicable regulations. That might not be possible or it
• 9:33
  might be cost prohibitive. So maybe you decide, well, we're
• 9:37
  going to only comply with these regulations in these
• 9:41
  jurisdictions when we absolutely have to.
• 9:43
  We're not going to do it across the board.
• 9:46
  Either approach is fine under ISO 42,001 and in general, but
• 9:49
  it gives you a system for developing that type of
• 9:52
  approach. I agree with you.
• 9:54
  I think ISO 42,000 and one is a wonderful approach, the
• 9:58
  artificial intelligence management system that you
• 10:00
  talked about the way of managing AI in a risk free or risk
• 10:07
  managed responsible way in a structured manner like other ISO
• 10:11
  standards. And it's a good thing.
• 10:13
  Even we recommend our clients the same thing and we also
• 10:17
  recommend that they take training on ISO because in ISO
• 10:20
  if they take training, they can be lead implemented, they can be
• 10:22
  lead auditor and so on. But that leads to a question
• 10:27
  while why should somebody? Let's first handle why should a
• 10:31
  company get certified in ISO 42,001?
• 10:34
  What's the advantage for them to follow ISO 42,001?
• 10:38
  Certification under ISO 42,001 gives you a variety of benefits.
• 10:43
  The 1st is credibility. When you're speaking to
• 10:46
  customers, regulators, other stakeholders about whether or
• 10:50
  not you are in fact complying with the standard, because it's
• 10:54
  one thing to say that you are, it's another thing to have a
• 10:56
  third party independent auditor come in and confirm that you
• 10:59
  are. So there's a huge credibility
• 11:01
  boost from that certification. Secondly, and interestingly
• 11:05
  enough, this is unique to the United States in that some
• 11:09
  states, like Colorado for example, have specifically
• 11:12
  called out ISO 42,001 as being a recognised risk management
• 11:17
  framework that gives a safe harbour if you are in a certain
• 11:23
  situation where you're potentially in violation of the
• 11:26
  Colorado Artificial Intelligence Act.
• 11:28
  So that's unique. And in fact, the European Union
• 11:32
  is is taking a different approach and is not specifically
• 11:34
  identifying 42,001 as a harmonised standard, or at least
• 11:38
  not yet. That's true.
• 11:42
  So that was for a company that they can, it's always good to
• 11:46
  have somebody else saying you're, you're certified rather
• 11:50
  than you yourself trying to brag about that you're doing right
• 11:53
  things on AI. But why should a person I can't
• 11:57
  get certified in ISO 42,001 Lead implementer or lead auditor or
• 12:01
  even go for the foundation training?
• 12:04
  Got it, Understood, Understood. So in terms of at an individual
• 12:08
  level, getting familiar with the standard, if you were going to
• 12:13
  be implementing or auditing an AI management system, then
• 12:16
  having an understanding of the key principles is, is a is an
• 12:21
  important first step. I will say that it's quite early
• 12:24
  days when it comes to ISO 42,001 implementation and there aren't
• 12:30
  a huge array of practical recommendations out there.
• 12:33
  So getting a survey of of all of the information that's out there
• 12:38
  and identifying best practises, pulling them from those
• 12:42
  resources will be incredibly helpful if you are out there
• 12:45
  trying to build or audit a programme.
• 12:49
  That does make sense. I think if your company wants to
• 12:51
  get certified, it must implement the ISO 42,001.
• 12:55
  And if it wants to implement, it's always good to have people
• 12:58
  certified. So get your staff certified, get
• 13:01
  your company certified, and that sets you on a good path to
• 13:05
  differentiate and demonstrate that you're doing responsible
• 13:08
  AI. Now that's all wonderful to
• 13:10
  hear, but what do you do on a day-to-day basis?
• 13:15
  Can you tell us about that as well?
• 13:17
  What me, Walter Haydock does Yeah, so I'm the founder of
• 13:22
  Stack Aware and we help AI powered companies measure and
• 13:25
  manage cybersecurity compliance and privacy risk primarily
• 13:28
  through ISO 42,001 readiness. So I work with companies in the
• 13:33
  healthcare, life sciences and B to B software space to build AI
• 13:38
  governance programmes and prepare for ISO 42,001
• 13:42
  certification. And the way we do it is using we
• 13:47
  use the standard as a way to deliver an actual AI risk
• 13:51
  management programme in addition to achieving certification.
• 13:54
  So we don't take a cheque the box approach, but rather focus
• 13:59
  on actually identifying the key risks for organisations when it
• 14:03
  comes to AI use and then providing actionable
• 14:06
  recommendations to manage them. So it's we both help people with
• 14:14
  ISO 42,001, but we take different approaches and the
• 14:19
  question is how can then somebody get in touch with you
• 14:22
  if they want to know more or they want to discuss what's the
• 14:24
  best possible way? The best way to get in touch
• 14:28
  with me is on LinkedIn. I'm the only Walter Haydock out
• 14:32
  there. My father has not joined the
• 14:34
  platform, so feel free to give me a follow.
• 14:38
  If you're interested in help with ISO 42,001 readiness then
• 14:43
  send me a direct message and would be happy to chat about it.
• 14:47
  That's so good to hear, Walter. And that was so nice that you
• 14:51
  shared your thoughts, inputs and also share us what you think
• 14:57
  about security risks, AI risks, how do we mitigate them?
• 15:01
  What can companies do and also the relevance of ISO 42,000 and
• 15:05
  one. So with that, I would say thank
• 15:08
  you so much for your time and it was wonderful to have you.
• 15:12
  Thank you very much. I appreciate the opportunity.
• 15:15
  Thank you for joining us on the Fit for Privacy podcast.
• 15:18
  We hope you found today's conversation valuable and
• 15:20
  thought provoking. Subscribe for more insights like
• 15:23
  this. If you enjoyed this episode,
• 15:25
  we'd appreciate that you'd share it and write us a review.
• 15:28
  For consulting, visit www.fitforprivacy.com.
• 15:33
  For certifications and training on ISO standards, visit
• 15:36
  www.growskills.store. You can also contact us for
• 15:40
  bespoke training for your staff and management.
• 15:43
  Until next time, stay safe, stay compliant, and grow your skills.