Information security, standards, regulation, privacy and risk management.
By Roy Kish – Infoguard, part of the Idor Group
We meet more and more organisations today that are already using AI, even if they have not yet defined a structured policy on the subject.
Employees use Generative AI tools to draft documents, summarise meetings, analyse data and write code. Marketing departments connect AI to customer information, service teams deploy chatbots, and business units begin running AI Agents with access to corporate systems and data.
As far as we at Infoguard are concerned, the question is no longer whether AI will enter the organisation. In most cases it is already inside.
The important question is a different one: who manages it, who supervises it, and who is accountable when something goes wrong?
Regulation is no longer a matter for the future
In the world of artificial intelligence, regulation is moving fast.
The EU AI Act illustrates the shift from general principles to a framework that sets clearer requirements around the use of AI systems. The more a system affects people, rights or significant decisions, the more control, documentation, transparency and oversight the organisation is required to provide.
But we at Infoguard, as an information security company, advise organisations not to look only at AI regulation.
In practice, the use of AI already meets existing obligations in the areas of privacy, information security, risk management, supplier contracts and management accountability.
Even an organisation that does not operate directly under European regulation needs to ask itself what happens when an AI tool processes personal data, gains access to sensitive information or influences business decisions.
As we see it, this is no longer only a technological question. It is a management question.
Privacy has to enter at the specification stage
One of the points we emphasise again and again is that it is not wise to wait until the end of the project to talk about privacy.
If an AI system is given access to the CRM, to correspondence, to employee documents, to customer data or to sensitive business information, you have to stop and ask a few basic questions:
- Do we really need all of this data?
- Are we permitted to use it for this purpose?
- Is it transferred to an external supplier?
- Where is it stored?
- Is it used to train the model?
- Who can access it?
- What happens to the data when we stop using the system?
These are exactly the places where principles such as Privacy by Design, Data Minimization and information lifecycle management turn from something theoretical into a working process.
We at Infoguard prefer to see privacy questions entering already at the use case evaluation stage, and not only after the system has gone live.
Standards make governance something you can actually manage
Regulation can tell us what is required. But the organisation still needs a method that will help it manage this in practice.
This is where ISO/IEC 42001 comes in – the international standard for an artificial intelligence management system.
We see it as an important framework because it obliges the organisation to look at AI as a complete management system: policy, role holders, risks, controls, objectives, monitoring and continuous improvement.
Alongside it, ISO/IEC 27001 provides the basis for information security management, and ISO/IEC 27701 adds the privacy management layer.
In practice, the three worlds connect:
- ISO 27001 – how we manage information security.
- ISO 27701 – how we manage privacy and personal data.
- ISO 42001 – how we manage AI systems and the risks associated with them.
As far as we are concerned, this is a natural connection. An organisation that has already built good governance processes around information security and privacy does not need to start from scratch, but it does need to extend them to the world of artificial intelligence, Agents and AI.
An AI policy is far more than a list of tools
We see quite a few organisations that start correctly but stop too early.
They publish a list of permitted and forbidden tools and think they have an AI policy.
That is a start, but real governance has to go further.
We recommend also defining: what information may be entered into AI tools, which uses require approval, how a new supplier is evaluated, who is permitted to connect AI to a corporate system, when the CISO, the DPO or legal counsel are involved, and which decisions require Human Oversight.
In addition, it is worth producing a structured AI Inventory.
That is, knowing which AI systems and uses exist, who owns them, what data they access and what their risk level is.
You cannot manage something you do not know exists.
So whose responsibility is it?
This is one of the questions we hear most often.
The answer is that you cannot place all the responsibility on a single department.
- IT manages the systems.
- The CISO manages information security risks.
- The DPO examines the privacy aspects.
- Legal counsel deals with regulation and contracts.
- The business unit is usually the one requesting deployment and is accountable for the business impact (BIA).
We therefore recommend shared but clearly defined responsibility.
Every significant system or use case needs an Owner. In parallel, the organisation has to decide who holds overall accountability for AI policy and risk management.
We like to test this using four simple questions:
- Who approved the use?
- Who supervises and documents it?
- Who manages the risk?
- Who is accountable if something goes wrong?
If there is no clear answer to all four, the governance is probably not yet mature enough.
And what about the employees?
Even the best policy will not help if employees do not know it exists.
We see a growing risk today of Shadow AI – employees using AI tools the organisation is not aware of at all.
AI Literacy and employee training therefore have to be part of the process.
Employees need to know what information must not be entered, when a result requires human review and when a new tool must go through approval.
In addition, a supplier who manages AI services externally and in a compliant way makes it possible to map or reduce the phenomenon and its risks, and to bring working patterns into controlled and managed frameworks.
How we at Infoguard look at this
We at Infoguard accompany organisations at the meeting point between information security, privacy, regulation, standards and risk management.
As we see it, the move to AI does not reinvent the rules of the game. It requires the organisation to take the principles it already knows and extend them to a new, faster and more dynamic world.
As part of information security services for businesses, we help organisations connect AI policy, risk assessments, privacy, standards, organisational accountability and employee training – so that AI adoption is carried out as a managed process and not as an isolated initiative.
So where do you start?
We recommend starting simply:
- Map the existing artificial intelligence systems and uses.
- Classify them by data, permissions and risk level.
- Define an AI policy and privacy rules.
- Set an Owner and an approval process for significant uses.
- Examine gaps against relevant regulation and standards.
The question is no longer whether the organisation will use AI.
The question is whether artificial intelligence is advancing faster than the management system around it.
As far as we are concerned, AI Governance is not a barrier to innovation. It is what allows an organisation to innovate without giving up control, privacy and accountability.
This article was written in collaboration with the information security experts at Infoguard.