Page 384 - CyberSecurityEssentialsEnglish

the context of use, and the people affected. Commission guidance makes clear that training
should not be uniform for everyone, but built around the role, the risk, and the actual tool
[8].

A management system standard for artificial intelligence focuses on the management

system itself, while an impact assessment standard adds a method for assessing effects. A
further standard sets requirements for bodies that audit and certify AI management

systems, reflecting the field’s movement from general principles toward a more mature
structure for evaluation and assurance [3][4][9].

TABLE 8-11: HOW AN ORGANIZATION USES LAWS AND STANDARDS WITHOUT CONFUSING THEM

Instrument What it gives you What it does not give you

Binding obligations with A design for your specific use
Law and regulation
consequences for breach. case.

A management A structured way to manage AI A guarantee that any particular
system standard activity. system is safe.

An impact
A method for identifying and A substitute for legal advice in
assessment
documenting effects. your jurisdiction.
standard

A voluntary risk A shared language and a cycle
Legal compliance on its own.
framework of functions.

Evidence about a management Proof that a specific application
A certification
system or a vendor. is fair or accurate.

Expectations particular to your Coverage of every jurisdiction
Sectoral guidance
field. you operate in.

The Obligations and Assurance Register
To avoid treating law and standards as separate lists, an organization creates an obligations
register linking each obligation to its source, its scope, its owner, the evidence required, and

the review cadence. The source may be a law, a sectoral regulation, a contract, an internal
policy, or a client requirement. Linking to evidence turns a general statement into something
testable: documented training, an impact assessment, an access log, a user notice, or a right

of appeal.

Assurance does not mean that an independent body reviews everything from the outset.
Layers of evidence can be built: self-verification for low-impact uses, specialist review for
medium uses, and independent testing or audit for high-impact cases. The question is how

383