The Schellman Blog

Within a few months of their latest update to their Data Protection Requirements (DPR) to address a coding incident (version 9.1), Microsoft released a draft or “pre-read” for their version 10 requirements that will be utilized for its Supplier Security and Privacy Assurance (SSPA) process as of the 2025 fiscal year. Arguably the largest update to the DPR since September 2018, v10’s new mandates address artificial intelligence (AI) and include important references to ISO 42001 that suppliers may want to take advantage of during their next compliance cycle.

Stepping foot into Davos for the very first time was akin to entering a realm of unparalleled wonder. While getting the invitation itself had been surreal, actually walking in as a delegate of the Cyber Future Foundation felt like a dream materializing into reality.

Following the publication of ISO 42001, many organizations are more seriously considering adherence to this intriguing standard for artificial intelligence (AI). Those familiar with established ISO standards understand that this newer framework for regulating AI will be similarly rigorous and any opportunity to streamline certification, like using a gap assessment, will be enormously advantageous.

The need for responsible, trustworthy, and ethical use of artificial intelligence (AI) has been a hot topic over the past couple of years, prompting the release of regulations such as NIST's AI Risk Management Framework to help organizations secure the evolving tech. Additional standards have emerged to address the need to implement safeguards addressing the security, safety, privacy, fairness, transparency, and data quality of AI systems throughout their life cycle—including ISO/IEC 42001.