ADAPTING EXISTING PRACTICES FOR ISMS-CERTIFIED ORGANIZATIONS IN SUPPORT OF RESPONSIBLE AI

Prior to adoption of Artificial Intelligence (AI), organizations may be required to comply with certain industry standards to ensure customer confidence and interoperability of their products, which demands resource allocation and designated responsibilities. For Malaysian public offices certified under the Information Security Management System (ISMS), compliance with a new standard in support of Responsible AI would entail further resources and new reporting structures. Hence, this study proposed the adaptation of current practices for these organizations at the early stages of AI adoption. Ten sources, chosen for authenticity, credibility, representativeness, and meaning, provide the basis for the relevant proposals, including context establishment, risk identification, risk prioritization, and focus area for each control in Annex A of ISO/IEC 27001:2022. The results outlined key actions to support Responsible AI, with future research focusing on validating this framework in ISMS-certified settings.