Standards
ISO Frameworks
BrightState builds against two international standards for AI governance. Both are published by ISO and IEC under the AI Management Systems family.
ISO/IEC 42001:2023
AI Management Systems
The first international standard for AI management systems, published December 2023. It sets out requirements for organisations to establish, implement, maintain, and continually improve a structured management system for responsible AI development and use.
The standard follows the same Annex SL structure as ISO 9001 and ISO 27001, covering AI policy, roles and accountability, risk management, impact assessment obligations, transparency practices, and continual improvement cycles. It applies to any organisation that develops or deploys AI systems, regardless of sector or size.
ISO/IEC 42005
AI System Impact Assessment
Provides a structured methodology for assessing the potential impacts of AI systems on individuals, groups, and wider society. Where 42001 covers the management system, 42005 provides the tooling for evaluating what a specific AI deployment could cause before it is used.
The standard guides organisations through identifying affected parties, assessing severity and likelihood of harm, documenting mitigations, and producing a defensible impact record. For public sector AI, this kind of structured assessment is increasingly expected by regulators and commissioners.
How we apply them
Frameworks in practice
AI policy and accountability
42001 requires a documented AI policy and defined accountability structures. We maintain both, with clear ownership of decisions about how SentinelQX is trained, tested, and deployed.
Impact assessment before deployment
Before any pilot, we run a 42005-structured impact assessment. That covers who the system affects, what could go wrong, and what controls are in place. The record is produced before use, not reconstructed after.
Risk-proportionate controls
Both standards treat risk management as proportionate to actual exposure, not a checkbox. We assess the severity and likelihood of specific failure modes and apply controls to those, rather than applying blanket policies.
Questions about our governance approach? contact@brightstate.ai