Model risk managers often wait for a "definitive" AI standard before implementing governance controls, only to find their systems don't align with the actual requirements. This delay is due to five persistent misconceptions about international standards.
These myths are comforting because they suggest standards will solve governance problems. However, standards are tools, not solutions. Here's what you need to know.
Myth 1: International Standards Create Universal Rules Everyone Must Follow
Reality: Standards don't regulate; they translate policy ambitions into processes.
Sergio Mujica from ISO stated, "We do not create policies, we do not establish regulations. That's the job of policymakers and governments. What we do is support the implementation of those ambitions."
For your team, ISO/IEC 42001 won't determine the legality of your facial recognition system. The EU AI Act does that. The standard offers a framework to demonstrate compliance with applicable regulations. It's the operational layer between "be accountable" and "here's how we document accountability."
Start with your regulatory obligations. Use standards like ISO/IEC 42001 or ISO/IEC 23894 to organize your response. Don't wait for a standard to dictate actions; use it to structure what you're already required to do.
Myth 2: You Should Wait for Standards to Mature Before Implementing Them
Reality: Standards need real-world testing to evolve, and you need them now.
Philippe Metzger from IEC advised, "Don't start from scratch. If you have high-level policy objectives, use the standards that exist." Many AI standards are new, meaning practitioners and standards bodies are learning together.
Your procurement process is an immediate testing ground. When acquiring an AI-enabled system for clinical decision support, you're already asking about performance verification, safety assurance, and impact assessment. These questions align with standards like ISO/IEC 25059 for quality models and ISO/IEC 42005 for impact assessments.
Implement the standard, document its effectiveness, and share your experience with your national standards body. Your operational experience influences how these standards evolve.
Myth 3: Each Jurisdiction Needs Its Own Approach to AI Governance
Reality: Fragmented approaches create compliance chaos for systems operating across borders.
AI systems cross jurisdictions constantly. Different interpretations of "risk assessment" or "transparency" lead to regulatory arbitrage, not risk management.
Seizo Onoe from ITU highlighted the need for common solutions. International standards provide a foundation without requiring identical technologies. Your content authentication method doesn't need to match others exactly, but it should interoperate.
For model risk managers, reference international standards even when operating domestically. If your organization expands into new markets, you can adapt the same foundation. ISO and IEC aim for "one standard, one test, one certificate" recognized across markets.
Myth 4: Standards Are Technical Documents for Engineers
Reality: Effective standards include perspectives from governments, consumers, industry, and affected communities.
Your model validation team can't create a complete AI Management System alone. You need input from legal counsel, business units, data protection officers, and affected communities.
Mujica emphasized that implementation requires more than AI specialists. National standards committees bring these stakeholders together.
When implementing ISO/IEC 42001, form a cross-functional group. Include procurement, internal audit, and business unit representatives. Their questions will reveal challenges that a purely technical reading might miss.
Myth 5: Publishing a Standard Completes the Work
Reality: Publication begins the process of implementation support.
Mujica warned, "Publishing a standard does not mark the end of the process, but the beginning. Users need support to understand, apply, and evaluate standards in their own contexts."
When you open ISO/IEC 42001, you'll find it defines requirements but doesn't offer a step-by-step guide for your specific situation. That's intentional; the standard must work across different contexts.
You need training on interpreting requirements, examples of implementations, and forums for questions. Your national standards body should provide these resources. If not, you're working with a standards organization that hasn't moved beyond publication.
What to Do Instead
Start with your regulatory obligations and risk profile. Map them to relevant international standards. Implement the controls those standards describe, document what works, and participate in standards development through your national body.
Treat standards as operational infrastructure, not compliance checkboxes. They're most valuable when they help you organize necessary work, like defining risk tiers and documenting model development.
The AI for Good Global Summit identified three priorities: capacity building, investment, and collaboration. For your team, this means training on standards interpretation, budgeting for implementation, and partnering with other teams facing similar challenges.
Metzger called standards "invisible infrastructure." Your users won't see ISO/IEC 42001 compliance, but they'll benefit from the reliability and assurance it enables. That infrastructure doesn't build itself, and it doesn't wait for perfect clarity before you start.
