It seems like every week there is a new AI-driven threat appearing in the news headlines. From spreading misinformation to taking over jobs to disrupting critical infrastructure to destroying humanity as we know it, the message is clear – AI has great potential yes, but it also poses tremendous risk. This message is typically followed by calls for more governance and there is no shortage of ideas on how to achieve this.
Governments, organisations, consortia and the UN Security Council itself are considering AI risk and rolling out councils, advisories, guidelines, frameworks, plans and laws – from the EU AI Act to the NIST AI Risk Management Framework to the US Action Plan to China’s Action Plan for AI Governance to Anthropic’s Three-Point Plan – though outlining varied approaches, they all agree on one thing: the need for safe, transparent and secure AI systems that remain under human control.
However, without one very key ingredient, the call for responsible AI is nothing more than a vague aspiration. And that key ingredient is international standards.
Why standards matter
International standards provide the framework that can help ensure any technology is safe, interoperable and efficient in a way that is measurable. It’s essentially a voluntary system of checks and balances that can inform policy and regulation and facilitate global exchange. International standards make plans like Dario Amodei’s actionable.
Often misunderstood, international standards do not block innovation and they are not the same as regulation. They are voluntary guidelines that are actionable and measurable and therefore can have a real impact, especially in testing and measuring safety and performance uniformly across borders. They define what AI governance looks like in practice: how risks should be assessed, how systems should be tested, what evidence should be recorded, how incidents should be reported and how organizations can demonstrate that agreed requirements have been met.
Why is this important? Let’s look at aviation as a practical example. Governments don’t tell aircraft manufacturers to build safe planes and then hope for the best. Safety must be proven through rigorous testing, evaluation and verification. Manufacturers must provide evidence that their aircraft meet the technical requirements and comply with regulations before they can take off.
AI should be no different. Testing, evaluation and assurance are extremely important. If an AI company says its chatbot is reliable or its AI model won’t produce harmful outputs, what evidence can it provide to prove that?
International standards developed by the joint IEC and ISO committee SC 42, for example, are referred to in numerous regulatory discussions around the world. Developed by industry, government, academia and civil society, they help establish not only what should be assessed, but how those assessments should be carried out and how results can be validated. Here are just a few examples:
- ISO/IEC 42001 is the first certifiable international standard for AI management systems. It provides organizations with a clear and auditable framework for governing, monitoring, and continuously improving their AI development and deployment processes.
- ISO/IEC 42005 complements it with a structured methodology for AI system impact assessment, requiring companies to evaluate potential effects on individuals, groups and society before and during deployment.
- ISO/IEC 42119 series of international standards aims to provide structured approaches to evaluating generative AI systems and their outputs.
The challenge of generative AI
One of the challenges of generative AI is it has a general-purpose nature, and inputs and outputs are in natural language. This leads to a higher complexity in assessing quality, including the need to evaluate responses in different modes such as text, audio, image and video. Various specific approaches to evaluation have developed including red teaming, and benchmarking.
This raises some important questions. How can we measure reliability or accuracy when there may not be one single correct answer? How do we measure harmful outputs? How can we ensure a system is reliable or robust if its answers are not predictable?
These questions need to be answered if we are to build safe AI systems that regulators, manufacturers and end users can trust.
This is why work on standards for testing and evaluating generative AI is increasingly important. Efforts such as the above mentioned ISO/IEC 42119 series of international standards that are currently being developed seek to provide structured approaches to evaluating generative AI systems and their outputs. This helps to create greater confidence in how these technologies are assessed.
Beyond the headlines
There is a lot of fear and uncertainty around AI and its potential to do harm at the moment. There is also a lot of potential for it to do good, if it is governed correctly. The question we need to be asking, then, is how do we determine whether an AI system is safe, secure and trustworthy?
The future of AI may lie not only in the safeguards that governments put in place but in the methods to verify that those safeguards are being erected.
