ISO 42001 Training

ARTIFICIAL INTELLIGENCE MANAGEMENT SYSTEM | ISO 42001 TRAINING

Using artificial intelligence in the institution is not the same as managing artificial intelligence in the institution.

ISO 42001 Training; yapay zeka kullanan, geliştiren veya hazır yapay zeka servislerini iş süreçlerine alan kurumlar için yapay zeka ynetimini başından sonuna kadar ele alır. Katılımcılar standardın ne istediğini, kurum içinde hangi politikaların ve kontrollerin gerektiğini, riskleri nasıl değerlendireceklerini ve KVKK’nın iş yerlerinde üretken yapay zeka kullanımına dair beklentilerini sade bir dille ğrenir.

Check out the Training Flow Request a Training Plan
ISO 42001 Standard Artificial Intelligence Risk Management KVKK Productive AI Guide EU Artificial Intelligence Directive Responsible AI
AI Management Maturity Dashboard
POLİTİKA + CONTROL
Institutional policy
kuralı
risk management
haritası
Usage control
gzetim
9 control area, 38 control items
Tüm AI life cycle in scope
KVKK integrated productive AI guide
42001 The first certifiable international standard designed for artificial intelligence management.
9 Alan Control set under nine headings, from policy to data management, from external services to impact assessment.
KVKK The Institution's guide on the use of productive artificial intelligence tools in workplaces is online.
AB YZ The European Union Artificial Intelligence Directive imposes institutional order requirements for high-risk use.
PURPOSE OF EDUCATION

The use of artificial intelligence is not management alone; When the institution binds this with rules, records and control, it becomes a management system.

Artificial intelligence is already in use in many institutions. Employees print e-mails, summarize documents, produce images, and print codes. The problem is that this usage is often invisible on the enterprise side. Which tool is used, with which data, for what purpose, and by whom? The answer is often unknown.

This is exactly where ISO 42001 comes into play. Standard; It requires tying the use of artificial intelligence to a policy, determining responsibilities, assessing risks, measuring impacts, keeping external services under control and monitoring results. This training simplifies what the standard requires; It reinforces each topic with concrete examples of how to apply it within the institution.

Amaç: Katılımcıların kurumlarındaki yapay zeka kullanımını grünür kılması, yapay zeka politikası yazabilmesi, riskleri ve etkileri değerlendirebilmesi, dış servis kullanımını ynetebilmesi ve KVKK’nın yayımladığı üretken yapay zeka rehberindeki beklentilere yanıt verebilmesidir.
When AI use is invisible, it cannot be managed. Çalışanlar kurum bilgisi olmadan yapay zeka araçları kullandığında, hangi verinin nereye gittiği bilinmez. Bu kullanım biçimi “glge yapay zeka” olarak adlandırılır ve KVKK’nın yayımladığı rehberde de en kritik risklerden biri olarak ne çıkar.
Artificial intelligence risks are not the same as classical information security risks. The model gives biased results, produces a wrong but convincing answer (hallucination), its decision cannot be explained, the personal information of others is included in the data on which it is trained; It cannot be solved by classical encryption or access control. These require a different understanding of risk management.
Over-reliance on AI output proliferates error. KVKK rehberi, yapay zekanın ürettiği sonuçları sorgulamadan kabul etmenin “otomasyon n yargısı” oluşturduğunu hatırlatır. Eğitim; yapay zeka çıktısının nihai karar değil, destekleyici bir unsur olarak kullanılması gerektiğini somut rneklerle gsterir.
Using ready-made artificial intelligence service is also a responsibility. Shared source code, customer information, product design or business strategy to third-party AI platforms; It may be processed outside the control of the institution. For this reason, not only institutions that develop models, but also institutions that use ready-made services need an artificial intelligence management system.
KVKK PRODUCTIVE ARTIFICIAL INTELLIGENCE GUIDE

Eğitim, KVKK’nın iş yerlerinde üretken yapay zeka kullanımına dair beklentilerini birebir kapsar.

Kişisel Verileri Koruma Kurumu, iş yerlerinde üretken yapay zeka araçlarının kullanımına ynelik bir rehber yayımladı. Rehber; glge yapay zeka, otomasyon n yargısı, ticari sır paylaşımı ve kurum içi politika ihtiyacı gibi başlıklarda kurumlara somut beklentiler getiriyor. Eğitim, bu beklentileri ISO 42001’in kontrol setiyle eşleştirir.

Basic messages of the KVKK guide

The guide recommends that institutions do not ban productive artificial intelligence tools, but use them consciously and regularly. Because even in institutions that completely ban it, employees continue to use these tools through their personal devices. This becomes more dangerous for the institution.

According to the guide, institutions; It should write the rules of use, determine which data can be shared with artificial intelligence tools, inform employees regularly, and ensure that artificial intelligence outputs are used as a supporting element rather than the final decision.

The training has been prepared with reference to the full text of the guide: KVKK — Use of Productive Artificial Intelligence Tools in Workplaces

  • The use of shadow AI creates risks beyond corporate control.
  • Trade secrets, source code and customer data should not be shared across tools.
  • Over-reliance on AI output creates automation bias.
  • Banning artificial intelligence completely is not a solution, its use should be regulated.
  • Institutions must write and announce an artificial intelligence usage policy.
  • Employees should receive regular information and awareness training.
EDUCATIONAL ACHIEVEMENTS

Participants learn to evaluate artificial intelligence management together on the axis of policy, risk and daily use.

The training brings standard knowledge to real scenarios. Each title; The use of in-house artificial intelligence is discussed through working examples with ready-made tools and warnings in the KVKK guide.

THE ESSENCE OF THE STANDARD

ISO 42001’i sade bir dille açıklar.

What the standard requires, on which subjects it expects rules to be written, and its common or different aspects with ISO 27001; It is explained with examples without drowning in technical jargon.

  • Purpose and field of application of the standard
  • Map of nine control heads
  • Relationship with the current information security system
ORGANIZATIONSAL DÜZEN

Establishes artificial intelligence policy and responsibility structure.

Artificial intelligence usage policy, ethical principles, internal AI committee structure and who is responsible for what are clearly defined.

  • AI usage policy template
  • AI committee roles
  • Escalation and decision paths
RISK ASSESSMENT

It manages the unique risks of artificial intelligence.

Risk types such as bias, wrong but fluent answer (hallucination), inability to explain the decision, personal data in the training data and theft of the model are handled practically.

  • AI risk types
  • Risk level determination
  • Integration into existing risk management
IMPACT ANALYSIS

It measures the impact of artificial intelligence on people.

How to evaluate and record the possible impact of an artificial intelligence application on employees, customers, applicants and sensitive groups is studied.

  • Impact assessment template
  • Vulnerable group and the fairness view
  • Conditions for human intervention in the decision
LIFE CYCLE

It manages artificial intelligence from start to finish.

You are taught which control will be applied at each stage, from need definition to data collection, from validating the model to going live, from monitoring to decommissioning when necessary.

  • Data quality and data source
  • Approval of the model and its transition to live
  • Monitoring, error trapping and recall
UYUM

It establishes common ground with the KVKK guide and the EU regulation.

KVKK’nın iş yerlerinde üretken yapay zeka rehberi, EU Artificial Intelligence Directive’nin yüksek risk sınıflandırması ve kişisel veri mevzuatı; ISO 42001 dokümantasyonuyla birlikte düşünülmesi ğretilir.

  • KVKK guide title by title
  • EU regulation risk classes
  • Automated decision and data protection
TRAINING FLOW

A comprehensive program ranging from getting to know the standard to a company-specific road map.

Program; It can be adapted as two days basic, three days practitioner or five days auditor competency, depending on the institution's artificial intelligence maturity and target calendar.

01 Why is artificial intelligence a separate management issue? The new types of risks that generative artificial intelligence, classical machine learning and automatic decision-making systems bring to the workplace are explained with current examples.
02 Structure of the ISO 42001 standard The topics on which the standard expects rules to be written, nine control headings and application areas are explained in simple language with examples.
03 Artificial intelligence order within the organization Artificial intelligence usage policy, artificial intelligence committee structure, responsibility sharing and senior management ownership are studied practically.
04 Assessing artificial intelligence risks The evaluation method is shown for risk types such as bias, wrong answer, unexplained decision, personal data leakage and model security.
05 Impact analysis and fairness How to evaluate the possible impact of an artificial intelligence application on humans, when to require human intervention, how to record it.
06 Reflection of standard controls on work Policy, provenance, lifecycle, data management, external service, usage, impact and reporting controls; mapped to real business processes.
07 Monitoring, remediation and incident management İç denetim, ynetim toplantıları, yapay zeka kaynaklı olayların ele alınması ve continuous improvement dngüsü uygulamaya oturtulur.
08 Documentation and roadmap The certification process, gap analysis, document set, evidence management and a 90-day road map specific to the participating institution are designed together.
TRAINING MODULES

Standard, risk method and daily practice meet in the same program.

M1
ISO 42001 standard in plain language The purpose, scope, nine control headings, terminology and how to combine the standard with the existing information security system are explained with examples.
M2
AI policy and institutional order Artificial intelligence usage policy, ethical principles, artificial intelligence committee, job descriptions, escalation methods and senior management ownership are covered.
M3
Artificial intelligence risk management Bias, wrong result, unexplained decision, personal data in training data, model security and operational risk assessment methods.
M4
Impact assessment and responsible AI Sensitive group analysis, fairness, explainability requirements, human audit requirements, transparency and recording discipline.
M5
AI lifecycle controls Data quality and provenance, model validation and validation, go-live, monitoring, error trapping, retraining and decommissioning.
M6
Foreign services and regulatory compliance Hazır yapay zeka servisleri, veri paylaşımı kuralları, KVKK üretken yapay zeka rehberi başlıkları, EU Artificial Intelligence Directive’ne uyum ve belgelendirme yol haritası.
DOMALI ATÖLYELER

Training makes learning permanent through real artificial intelligence scenarios.

Katılımcılar yalnızca dinlemez; yapay zeka kullanım inventory çıkarır, politika yazar, risk ve etki değerlendirmesi yapar, dış servis kullanımını sorgular ve kendi kurumları için yol haritası tasarlar.

USAGE INVENTORY Making the invisible visible All points of use within an organization, including shadow AI, are extracted; The owner, what data it uses and the risk level are determined.
POLITICS WORKSHOP Artificial intelligence usage rules Which tools can be used by employees, with which data, in which situations? It is written in accordance with the headings in the KVKK guide.
RISK WORKSHOP Artificial intelligence risk map Bias, incorrect results, explainability and personal data risks are evaluated for the customer segmentation model.
IMPACT ASSESSMENT Automated decision scenario Sensitive groups, impact level and human control requirements are determined through automatic credit scoring or a recruitment screening scenario.
FOREIGN SERVICE Use of ready-made artificial intelligence In-house use of a common ready-made artificial intelligence service; The contract is evaluated in terms of data sharing rules, recording and auditing.
ROADMAP 90 day plan A road map consisting of steps towards maturity determination, quick wins and certification is prepared for participating institutions.
WHO SHOULD JOIN

Adaptive training for all roles using, developing or purchasing AI.

Artificial Intelligence Committee
Information Security Managers
Data and Model Teams
Product and Project Managers
Legal and Compliance Units
Internal Audit and Risk
KVKK and Data Protection
Senior Management
ÇIKTILAR

At the end of the training, the institution's artificial intelligence maturity becomes measurable and sustainable.

Participant gains

  • ISO 42001’in ne istediğini sade bir dille anlatabilme
  • Ability to write artificial intelligence usage policy for the institution
  • Ability to evaluate artificial intelligence risks in the right category
  • Ability to evaluate and record impact
  • Mapping lifecycle controls to business processes
  • Ability to manage the use of ready-made artificial intelligence services
  • Ability to meet the expectations in the KVKK productive artificial intelligence guide

Institutional outputs

  • AI usage policy template
  • Artificial intelligence committee terms of reference
  • Yapay zeka kullanım inventory şablonu
  • Risk assessment methodology and sample matrix
  • Impact assessment template
  • Ready-made artificial intelligence service usage checklist
  • 90-day road map specific to the institution

Transform AI into a discipline governed by rules, records, and audits.

Plan a training program specific to your organization's needs, covering the expectations in the ISO 42001 standard and the KVKK productive artificial intelligence guide.

Request a Training Plan

References: ISO/IEC 42001:2023 Artificial Intelligence Management System Standard, ISO/IEC 23894:2023 Artificial Intelligence Risk Management Guide, EU Artificial Intelligence Regulation, KVKK Guide for the Use of Productive Artificial Intelligence Tools in Workplaces.