ISO 27091: the questions buyers ask
Five short answers, each with the source behind it. They are written for someone who has to decide what to do next, not for someone who wants a summary of the standard.
What is ISO/IEC FDIS 27091?
ISO/IEC FDIS 27091 is the final draft of a first-edition international standard on privacy protection in artificial intelligence.
Read the answerDoes ISO 27091 apply to my organization?
It is aimed at any organization of any size that develops or uses AI systems, including government and not-for-profit organizations.
Read the answerWhat evidence should we keep for AI privacy?
Keep the system register, the data and provenance record, the impact assessment, the supplier terms, the logs and their retention, the incident route and the review minutes.
Read the answerThe rules this is built from
Read from the real rules, not invented. The 38 control pages are the ISO/IEC 42001:2023 Annex A controls, read from the standards library: 101 evidence lines and 80 common failure lines, each cited to its control. The privacy layer is read from the public ISO/IEC FDIS 27091 record, the ISO abstract and the stage feed. The draft text is not public and is not reproduced.
ISO/IEC 42001:2023, Annex A
Each page states the control in our words, the evidence an auditor asks for, the common gaps and the privacy work the draft points at.
Open the control indexWhat the draft covers
Scope and role, the lifecycle, the evaluation of consequences, treatment, operation and evidence.
Read the public recordThe role and the four markets
Controller or processor, the lifecycle stages, and the instruments named for the US, EU, UK and Australia.
Open the referenceThe ISO/IEC FDIS 27091 text is not public and is not reproduced. The ISO/IEC 42001:2023 text is not reproduced either. Every source.