Your Team Is Already Using AI. Who Is Managing the Risks?
Your Team Is Already Using AI. Who Is Managing the Risks?
A member of your team pastes a customer email into an AI tool to save time. Someone else uses it to draft a report. A manager asks it to help choose which job applicants should reach the next stage.
The work moves faster.
But who approved those uses? Who checked what information could be shared? And who will notice if the answer is wrong?
If your business cannot answer those questions, useful shortcuts may be creating risks that nobody owns.
A small error can reach a customer before anyone spots it. Private information can leave the business without a clear decision. A poor suggestion can shape a choice that affects someone’s future.
By the time a concern reaches a director, the result may already have been sent, used or acted on.
You need a clear view of how AI is being used and who is responsible for each part of that work.
ISO/IEC 42001 offers a way to build that understanding and turn it into daily practice.
For business owners, directors, team leaders and those who look after quality, people or information, the starting question is simple:
Your team is already using AI. Who is managing the risks?
AI stands for artificial intelligence. In everyday work, AI tools can help draft words, summarise notes, find patterns or support decisions. Some tools are easy to spot. Others are features within software your business already uses.
That means asking about AI use across the business, including features that staff may have switched on inside familiar systems.
A writing assistant might be helping sales staff. Meeting software may be creating notes. A service tool may suggest answers to customer questions.
Each use deserves a clear purpose and a suitable level of care.
ISO/IEC 42001 gives businesses a structure for managing AI.
ISO/IEC 42001:2023 is an international standard for AI management systems. It applies to organisations that develop, provide or use AI products or services. You can use it to manage AI-related risks and opportunities in a planned way.
In plain terms, an AI management system brings together the rules, people, checks and records that guide how your business uses AI.
It helps you set responsibilities, assess risks, consider effects on people and review whether your arrangements are working.
The work should reflect what your business does.
A company using AI to draft routine text will have different needs from one using it to help make decisions about people. A business building an AI product will have further work to consider across its development and use.
The standard gives you a way to bring those needs into a system that you can check and improve.
Start by looking at the tasks your team is trying to complete.
Perhaps staff want to reduce time spent writing reports. Maybe a manager wants quicker access to useful information.
Those aims can make sense. The next step is to understand what could go wrong, who could be affected and which checks would help.
A confident answer can still be wrong.
AI tools that create text can produce false statements, including made-up references, while presenting them in a convincing way. NIST, the US body that develops technical standards and guidance, identifies this as a risk of these tools.
Picture a staff member asking AI to summarise a customer agreement. The summary leaves out an important condition, but the wording looks clear and complete.
Someone uses it to plan the work. The team then delivers something that does not match the agreement.
This is an example of why the check needs to fit the task.
For a customer agreement, the person reviewing the result needs access to the source and enough knowledge to spot missing terms.
For a product claim, the reviewer needs evidence that the claim is true.
Simply asking another person to read the wording may not be enough. Decide what they need to check and give them time to do it.
Build that check into the work before the result reaches the next person.
Information also needs care.
Before staff enter customer details, staff records or private business material into an AI tool, your business needs to understand how that service handles the information.
Check the terms for the account and service you use. Ask what is stored, who can access it and whether it may be used to improve or train the supplier’s systems.
Settings, contracts and services can differ. Make decisions using the arrangements that apply to your own account.
If AI is used to process personal information, data protection duties still apply. The Information Commissioner’s Office explains that organisations need to consider these duties when designing and using AI systems.
Clear guidance helps staff know which information they may use, what needs approval and where to ask for help.
AI can also affect people through the choices it supports.
A tool used to sort job applications may influence who gets an interview. A customer service tool may suggest different responses to different people.
Look at whether the results are suitable and fair, and how a person can raise a concern.
The NCSC, the UK’s National Cyber Security Centre, highlights that AI can produce wrong or biased answers and that security needs attention throughout its use.
These risks need people with the right knowledge and authority to review them.
A supplier can explain its service. Your business still needs to decide whether that service is suitable for the task you want it to perform.
You also need to understand what happens when the tool is unavailable or changes.
If staff depend on it to finish essential work, agree how that work will continue during an outage. If a new feature changes how information is handled, review it before approving wider use.
Also review what a tool is allowed to do. If it can send messages, change records or pass information to another service, include those actions in your assessment.
Agree which actions need approval and who can give it. Ask how you can safely pause the tool, correct a change and find out what happened if something goes wrong.
For example, a draft customer reply gives someone a chance to check the facts before sending it. A reply sent straight to the customer needs different checks. Make that difference clear when approving the task.
Check whether the tool delivers the benefit you expected too. Include the time spent checking answers and putting mistakes right when reviewing any time saved.
A useful trial could compare similar tasks completed with and without AI, while applying the checks each task needs. Use what you learn to decide whether to continue, change the approach or stop that particular use. Record the reasons for your decision.
Clear ownership helps the whole team make better choices.
AI use can sit across several departments. IT may arrange access, managers may approve tasks, and staff may decide what to enter or how to use the result.
Write down who is responsible for each decision.
For example, a department manager might explain the business need. Someone responsible for information security might review access and data handling. A suitably skilled person might check the results.
Senior leaders need to approve the overall approach and provide the time, people and funds it needs.
Staff also need a clear route for reporting concerns.
Make it easy to say that a tool gave a poor answer or that private information may have been shared. A useful report gives the business a chance to act before the same issue spreads.
If people expect blame, they may hide mistakes or delay asking for help.
A calm response can help you find out what happened, reduce harm and improve the instructions for next time.
A practical review can show where to begin.
The following steps are useful starting points for businesses using AI. Preparing for certification also means reviewing all the requirements that apply to your chosen system.
- Find out where AI is being used.
Speak to each team. Ask which tools and features they use, what they use them for and whether they use business or personal accounts.
Keep a simple list with the tool, task, person responsible and information involved. Include who receives the result and whether it influences a decision.
Ask staff what help they need. This conversation can reveal useful tasks as well as uses that need closer review.
- Agree what your system will cover.
Decide which parts of the business, AI uses and related activities will sit within your AI management system.
Make those boundaries clear so that managers and staff understand which arrangements apply.
Include the services and suppliers involved in those uses. A customer should be able to understand what your system covers if you later describe your certification.
Review the boundaries when your business or its use of AI changes.
- Look at risks and effects on people.
For each use, ask what could go wrong, how serious it could be and who could be affected.
Consider wrong answers, unfair results, information exposure and disruption to work. Also look at the wider effects of the use on staff, customers and others.
Record the review and agree suitable action. Give greater attention to uses where a mistake could cause serious harm.
Check whether the planned action leaves a level of risk your business can accept.
- Set rules that staff can use.
Explain which tools and tasks are approved, what information may be entered and when a result needs review.
State who can approve a new use and how staff should report a problem.
Keep the wording clear. Use examples from your own work so people can see how a rule applies.
Test the guidance with a team member. If they cannot work out the next step, improve it before wider use.
- Check suppliers and access.
Review how a supplier handles information, supports customers and reports important changes or incidents.
Check the service terms and settings relevant to your account. Give staff access that suits their approved tasks.
Agree what happens when someone leaves, changes role or no longer needs a tool.
Keep a record of the checks and the reasons for approving the service. Review that decision when the task, service or risks change.
- Give people useful training.
Show staff how to check a result against reliable information. Explain the limits of the tools they use and the situations where they must ask for help.
Use realistic exercises, such as spotting a missing point in a summary or deciding whether information can be shared.
Check understanding through discussion and practice.
Managers need training too. They must know what they are approving and what evidence they need before accepting a new use.
- Test, review and improve your arrangements.
Before using AI for a new task, test it with suitable examples and decide what an acceptable result looks like.
Keep checking once it is in use. Look at errors, staff concerns, supplier changes and whether the tool is meeting its purpose.
Plan internal audits, which are checks of your own system, and bring the findings to management.
Agree actions, name the people responsible and check whether the changes worked.
These steps can help you build a clearer picture of AI use and the support your team needs.
They also give you useful evidence when customers ask how you manage the risks.
A clear explanation of approved tasks, information rules and checks is easier to support than a broad claim that AI is used responsibly.
Keep records that allow someone to follow important decisions. The detail should suit the task and the possible harm.
For a routine draft, that may mean showing who checked the finished work. For a use affecting people, you may need much more detail about the assessment, testing, decisions and ongoing review.
The benefits of ISO consultant support include turning uncertainty into a practical plan.
You may already have staff who understand your tools well. They may need help connecting that knowledge to the requirements of ISO/IEC 42001.
Or AI use may have grown without a shared plan, leaving several managers unsure about what they own.
An ISO consultant can help you review the current position, identify missing arrangements and decide what work to tackle first.
Good support starts with questions about your business, the tasks you use AI for and the people those tasks affect.
That helps keep the work relevant.
Your consultant can also help bring the right people into the review. The person who bought a tool may know its cost and features, while the person using it may see issues that have never reached management.
Bringing those views together can help you make better decisions.
Existing working practices may provide a useful starting point.
You might already have ways to approve software, train staff, review suppliers, deal with problems and check completed work.
Look at which of those arrangements can support AI management and where they need more detail.
For example, your current software approval form could be developed to ask about AI features, information use and the decisions a tool might influence.
A clear review helps you build on useful work while addressing the needs specific to AI.
Consultant support should also help your own team understand the system.
Staff need to know the rules. Managers need to explain their decisions. Leaders need to understand the main risks and the support required to manage them.
That knowledge will matter as new tools, tasks and features appear.
Compliant can introduce AI management support through a review of your current arrangements and help you plan your next steps towards ISO/IEC 42001.
Support can include helping you identify AI uses, agree responsibilities, review risks, develop clear guidance and prepare your team for checks.
The exact work should be agreed around your needs and the system you want to build.
A clear plan sets out what help is included, what your team will do and when progress will be reviewed.
Certification is voluntary. If you choose it, an independent certification body assesses whether your AI management system meets the standard within the agreed boundaries. ISO itself does not issue your certificate.
That assessment concerns your management system. It does not promise that every AI answer will be correct or that every use is free from harm.
The standard also does not replace the laws that apply to your business. Keep reviewing the requirements relevant to your work and the way you use AI.
Begin with a conversation across your teams.
Ask what they are using, what they hope it will improve and what currently worries them.
Choose one real task and follow the information, result and final decision through the business.
That gives you a starting point for a useful review.
Speak to Compliant about your certification plans and the AI management support your business needs.
Understanding your current use can help you set clear rules, make informed choices and give staff the support they need.
Start there, then build a system that helps your business use AI with greater care and confidence.
