Free readiness test
ISO/IEC 42001:2023 Lead Implementer: 40 free scenario questions
Establish, implement and continually improve an AI management system, including AI risk and impact assessment.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
You are leading AIMS implementation at a 3,000-person insurance group. Business units use AI for claims triage (built in-house), fraud scoring (bought from a vendor), a customer chatbot (vendor model fine-tuned on company data and offered to brokers under the group's brand), and dozens of generative AI tools staff signed up for individually. The CEO wants certification within 12 months to win a bancassurance partnership that specifically requires an AIMS covering 'AI used in customer decisions'. The CIO proposes scoping only the in-house claims model because it is best documented. The legal team worries that including the broker chatbot will create liability. Nobody has an inventory of AI systems, and two business units say they 'do not use AI' although their teams use automated underwriting rules with machine-learning components.
What should you do FIRST to define a defensible scope?
- AScope only the in-house claims model, as the CIO suggests, and extend later.
- BScope every AI tool used by any employee, including all individual generative AI subscriptions, to show maximum coverage.
- CInventory AI systems, determine roles, and scope AI used in customer decisions.
- DExclude the broker chatbot on legal advice and focus on internal uses.