ORO Labs has become the first organisation in the world to be awarded ISO 42001 certification for AI Systems Management. The ISO standard was only ratified in December 2023, and this award marks a significant achievement for the company.
Lalitha Rajagopalan, ORO Labs co-founder, said, “At ORO Labs, we see GenAI as a real game-changer for procurement. It delivers an easy, walk-up user experience and scales compliance in a big way. When we chat with our large, multinational customers, they all agree: improving user experiences with GenAI is a must for better data quality and process efficiency. They also see the need for solid governance and strict audit controls.
“Building AI capabilities isn’t just about the tech. It’s about creating smart workflows that automate compliance with the right safeguards for AI-powered recommendations and process automation. Trusting AI means having humans step in when a judgment call is needed.”
Who are ORO Labs?
ORO Labs is a no-code procurement orchestration platform. The company describes process orchestration as “the application of general process orchestration principles and tools to procurement use cases.” It impacts every stage of procurement across the enterprise, from the initial specification to requests for information to acceptance, delivery, and even payment.
As such, it touches multiple departments and systems across the business. There are many manual processes and workflows involved, and they are often complex. Additionally, those processes are rarely static. Depending on the industry, they may change constantly to meet the business’s and its customers’ requirements.
To cope with change, ORO Labs introduced its no-code approach, giving businesses the ability to adapt to change. Importantly, it built its platform as an end-to-end solution that customers could easily deploy alongside existing systems.
ORO Labs built its own Generative AI (Gen AI) solution to simplify the process further. Gen AI is used for various tasks, such as creating RFIs, summarizing text, and deploying chatbots.
Raising the bar for AI
Public Gen AI has received a mixed press due to the inaccuracies often present in its responses. When an organisation wants to take advantage of Gen AI for its business, it must build an AI instance on its data. However, access to tools that do more than just create an AI instance is needed to do that. Governance, security and adherence to compliance standards are also areas that organisations need to invest in.
ORO Labs has done precisely that. It says that this certification “marks the latest milestone in ORO Labs’ ongoing commitment to AI governance, including stringent data privacy and security policies.”
ISO 42001
ISO 42001 sets out the controls for how organisations develop, deploy, and operate AI. It is the cornerstone of new AI laws, including the EU AI Act. The standard has five key controls: risk management, AI impact assessment, system lifecycle management, performance optimization, and supplier management.
In addition to this, organisations will need to build additional controls. These will cover areas such as managing bias, treating people fairly, handling bad data, and meeting compliance requirements.
Some of these processes are ones that organisations should already have. However, those existing processes rely on human intervention and actions. As has already been seen with AI systems, the technology can have unexpected consequences as it creates connections between pieces of data. The two big challenges here are whether those connections are valid and where the underlying data came from.
The biggest challenge here is identifying where that data came from, and ISO 42001 does not go far enough in this area. Even the management controls fall short of requiring an AI to be able to point to all the places where it acquired the data to make a statement.
To highlight how challenging these are, OpenAI has admitted that ChatGPT cannot say where data came from. Nor is it able to remove false data created by its AI engine, a breach of GDPR. Any enterprise building its own AI will have to adhere to privacy laws, which require tight control of the AI.
What was involved in the ISO 42001?
To be awarded ISO 42001, ORO Labs was audited by Mastermind Assurance. Among the processes it reviewed were:
- AI system lifecycle
- Acquisition of data used in AI systems
- External reporting and communication of incidents related to AI systems to interested parties
- Utilization of external suppliers to support organizational use cases for AI systems
- Policies related to AI
- Processes for responsible AI system design and development
- Responsible and intended use cases of AI
- Assessing impacts of AI on individuals, groups of individuals, as well as societal impacts
After the assessment, David Forman, Founder and CEO of Mastermind Assurance, said, “ORO Labs was the ideal candidate to efficiently uplevel its existing systems and governance to this new benchmark, given the company’s long history of third-party assessments and compliance with similar information security and data protection frameworks.
“We look forward to observing the continued success of ORO Labs as they champion the adoption of ISO 42001 as the de facto standard for building trust with AI systems.”
Enterprise Times: What does this mean?
Take nothing away from ORO Labs. Being the first to gain ISO 42001 at a time when all eyes are on AI is a significant achievement. Having the auditors and assessors praise the organisation’s internal processes is also a major success.
It is interesting to see the auditor’s comments on observing ORO Labs’ ongoing success. Perhaps they want to see how ORO Labs deals with the risk of data drift. They may also be looking to see how it deals with the accuracy of the data over time and the processes they build under ISO 42001 to correct that.
One question that needs to be addressed is how often ISO 42001 will be audited. AI is changing fast, and that rate of change suggests that regular audits, even perhaps yearly, would be sensible. As the standard settles and the technology is better understood, audit time can be relaxed. However, that is unlikely to happen. That’s due to the number of organisations that want to be ISO 42001 certified and the need for qualified assessors.
For now, there will be a lot of people watching ORO Labs to see what ISO 42001 means to the business, its products and its customers. Will it improve sales? Will it be the difference between the company and a competitor in a bidding process? How will it impact product development? These are questions that will take time to answer.
