3 ways we implement ISO 42001 control A3.3 (reporting of concerns) to stay compliant

Coordinated vulnerability disclosure, whistleblowing, and external review.

Figuring out how to implement ISO 42001 controls from Annex A is a challenge. While Annex B provides some guidance, what this should look like in the real world isn’t always clear.

Specifically for control A3.3, here are the measures StackAware uses (and advises our clients to use) to meet the standard’s requirements:

1. Coordinated vulnerability disclosure

StackAware has a coordinated vulnerability disclosure program (CVD a.k.a VDP) through which we give safe harbor to ethical security researchers.

We also include as in-scope any AI outputs that are:

• illegal

• offensive

• unethical

or have otherwise adverse impacts.

We advise all of our clients to do the same.

A bug bounty program would be the next step. I encourage any company that can afford it to start one.

2. Whistleblowing

Sometimes only people inside or working with the organization know its worst flaws.

In addition to financial or other wrongdoing, we encourage reporting misuse of AI via our anonymous portal.

We tell all:

• Customers

• Employees

• Consultants

about the program as part of our standard contract language.

If you decide to implement A3.3, you’ll need an anonymous way to submit reports. This is easy to implement via Zapier or Google Forms.

Pro tip: make sure it actually WORKS, though; auditors may test!

3. External review

NIST’s AI Risk Management Framework (RMF) recommends you “collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system” (GOVERN 5.1).

That’s why we make our entire software bill of materials (SBOM) publicly-available. It shows all (known) AI training and processing in our supply chain.

And we encourage public feedback.

Clients can also do this through:

• customer and stakeholder interviews

• webinars

• surveys

Need to get the right controls in place to get ISO 42001 ready?

We specialize in working with AI-powered companies working in:

• Financial services

• Healthcare

• B2B SaaS

If you work at one of these and are looking to get ISO 42001 certified to:

• Build customer trust and meet new Microsoft supplier requirements

• Reduce the risk of AI-related hacks, leaks, and incidents

• Meet a growing range of regulatory requirements

then please: