How to organize ISO 42001 training and awareness

If you’re implementing ISO 42001 requirements for training and awareness, you’re probably wondering what needs to be done and which options exist. This article explains ISO 42001 requirements and presents the best ways to move forward with these very important activities.

ISO 42001 training & awareness requirements — clauses 7.2 and 7.3

In its clause 7.2 called “Competence,” ISO 42001 doesn’t say much, but it requires that companies (1) define competencies that are needed for particular roles; (2) evaluate if the employees actually have the required competencies based on their education, training, or experience; and (3) acquire the necessary competencies if they are needed.

Let’s say that you want to employ an ISO 42001 internal auditor — you would like this person to have thorough knowledge of the standard and to have auditing skills; you would check if this person has those competencies by asking about his or her experience and for certificates; and if this person does not have the required competencies, you would send them to a course where they would learn about the standard and about auditing techiques.

Clause 7.3 “Awareness” is also quite short — it requires that people working for the company must be aware of the AI policy, their contribution to AI governance, and the implications of not complying with AI policies and procedures.

So, how do you implement all of those requirements?

Learn more about the requirements here: ISO 42001 Requirements: Clauses and Structure.

How to organize ISO 42001 training

Training methods

There are many methods for acquiring competencies, i.e., how to train your employees — for example:

• Attending courses: This option is the most suitable for individuals who have a specific role in the company — such as, as already mentioned, the internal auditor, but this could also be, e.g., a software developer who is working with a particular AI technology.
• Organizing in-house training: This is suitable if you have a group of people who need to acquire certain knowledge — for example, what are the main requirements of ISO 42001, how to organize AI governance, etc.
• Reading literature: This method does provide in-depth knowledge, but it is often time-consuming and does not involve interaction — therefore, it is probably best used as an “add-on” to some other kind of training.
• Mentorship: This method is best suited for an individual with a specific role where there is already an employee with deeper experience.
• etc.

ISO 42001 courses

Regarding courses, the following courses are typically available from various training providers:

• ISO 42001 Foundations Course — intended for members of the AI governance project team, mid- or senior-level management, and scholars.
• ISO 42001 Internal Auditor Course — intended for people who are in charge of the ISO 42001 internal audit in their companies.
• ISO 42001 Lead Auditor Course — intended for auditors who want to perform certification audits, but also for consultants who want to boost their credentials.
• ISO 42001 Lead Implementer Course — intended for AI officers and other people in charge of implementing AI governance in their companies, but also for consultants who want to offer ISO 42001 compliance as a service.

Organizing in-house training

When you organize an in-house training for a group of your employees, the most important thing is to match your audience with the appropriate topics.

To define the audience, you should segment the employees in your company so that they have similar training needs — for example, you might have:

• Employees in a particular department — e.g., the software development department
• Employees in a particular hierarchy — e.g., members of the middle management
• Employees who are part of a particular process — e.g., handling suppliers of AI products
• etc.

Once you have segmented the employees, for each group you should define the most appropriate training topics — of course, you will start with the required competencies for their roles, but you should also consider the following:

• Specific requirements of the standard and of internal policies and procedures
• The department or the process they work in
• Whether the training should be made for beginners or advanced users
• Training duration

For example, you could organize a training about the basics of AI governance for your senior management, which would last one hour, and where you would present the most important requirements from ISO 42001 and from the company’s top-level AI policy.

How to organize AI awareness / AI literacy

There are several methods of raising awareness:

• Videos: This is a very powerful method for presenting any topic, because videos are easily distributed and easily remembered by the participants.
• Articles on your intranet or newsletter: Offer simple stories (with as many examples as possible) that can help employees understand why AI governance is important.
• Presentations: Organize shorter meetings where you can explain what new policies and procedures are being published, ask your employees for opinions about them, and clarify any misunderstandings.
• Discussions through internal forums: You can initiate and participate in concrete conversations arising from the use of AI systems.
• Etc.

Even though ISO 42001 uses the term “awareness,” the EU AI Act in its Article 4 introduces mandatory “AI literacy” — this literacy could be interpreted as raising awareness about AI systems. This is why you’ll often see the term “AI literacy” instead of “AI awareness.”

Options for delivering in-house training and awareness videos

There are basically three options to deliver in-house training or awareness videos:

Instructor-led in-classroom training. This is the traditional way of delivering training — you place everyone in a room, and the instructor presents all the relevant topics face to face. This enables attendees to ask questions and allows for some interactivity through shorter workshops, but organizing such training is difficult.

Instructor-led online training. This is similar to instructor-led in-classroom training; however, the main difference is that there is no physical classroom — the training is delivered through online tools like MS Teams, Zoom, or similar. This still enables attendees to ask questions and organize short workshops; while organizing such training is easier, there are still challenges because all attendees must be present at the same time.

Pre-recorded online training delivered via a training platform. This approach is different from the first two options — here, all the videos are pre-recorded and uploaded to learning management system (LMS) software that distributes the videos to attendees and tracks their attendance (and test results, if needed). This doesn’t allow direct engagement with the instructor (although some AI solutions are now addressing this problem), but organizing such training is far easier.

To learn how to choose between those options, read this article: Options for delivering NIS 2, DORA, and ISO 27001 training.

Do it properly

Ultimately, the success of your ISO 42001 implementation will depend on how much your employees know about the standard and about AI governance, and if they understand why it is important.

So make sure you complete training and awareness thoroughly to reduce the stress and chances of failure of your project.

If you want to set up ISO 42001 training and awareness for your employees, sign up for a free trial of the Company Training Account, the most practical way to organize company-wide training and awareness.