{"id":13411,"date":"2023-04-06T10:34:56","date_gmt":"2023-04-06T08:34:56","guid":{"rendered":"https:\/\/compleye.io\/?p=13411"},"modified":"2023-06-26T09:34:48","modified_gmt":"2023-06-26T07:34:48","slug":"the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for","status":"publish","type":"post","link":"https:\/\/compleye.io\/nl\/artikelen\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/","title":{"rendered":"De risico's van het gebruik van AI-tools zoals ChatGPT bij ISO 27001-naleving: Waar moet je op letten?\u00a0\u00a0"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong><em>Love it or hate it, ChatGPT, and in fact, AI (Artificial Intelligence) in general is here to stay.&nbsp;&nbsp;<\/em><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All those in favour say AI should be seen as a tool that can be used to make organisations and individuals more efficient, while all those against wonder if we are falling into the trap of quantity versus quality.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s an enormous subject with room for a multitude of opinions and endless debate.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, let\u2019s narrow it down to how it affects us. Let\u2019s delve into the ChatGPT compliance world.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">ChatGPT and compliance: are compliance officers at risk?\u202f\u202f&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When<a href=\"https:\/\/openai.com\/blog\/chatgpt\"> ChatGPT<\/a> emerged, copywriters, graphic designers, musicians and just about anyone else with a creative bent went into panic mode. Would jobs be lost? Would we forget how to write, design, draw, create?&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The possibility is not beyond the scope of the imagination. It\u2019s not unlikely that we will become less creative, less able to think for ourselves and more likely to become dependent on AI to do our jobs for us. In fact, recent studies have shown that AI will indeed be responsible for hundreds of thousands of job losses.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But, even though ChatGPT mimics humanness in some ways (even referring to itself as \u2018me\u2019 and \u2018I\u2019), something we must remember is that AI doesn\u2019t have:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Personal experiences&nbsp;&nbsp;<\/li>\n\n\n\n<li>Emotions&nbsp;<\/li>\n\n\n\n<li>Intrinsic human memory&nbsp;&nbsp;<\/li>\n\n\n\n<li>The ability to sympathise&nbsp;&nbsp;<\/li>\n\n\n\n<li>The ability to empathise.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">So, are compliance officers risk?&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To ascertain this, we first need to look at whether compliance officers have the ability to empathise or sympathise.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kidding!&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What we need to look at is what ChatGPT is and what limitations it has.&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is ChatGPT?\u202f\u202f&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The GPT in <a href=\"https:\/\/openai.com\/blog\/chatgpt\">ChatGPT<\/a> stands for \u201cGenerative Pre-trained Transformer which is a type of large language model (LLM) neural network that can perform various natural language processing tasks such as answering questions, summarising text and even generating lines of code.\u201d \u2013 Al Jazeera&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ChatGPT is an AI model that has been trained to provide answers to instructions provided by users. It does this using RLHF (Reinforcement Learning from Human Feedback) and PPO (Proximal Policy Optimisation).&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Open AI (the organisation that developed Chat GPT) provides this infographic to explain the learning process.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"608\" src=\"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-1024x608.png\" alt=\"\" class=\"wp-image-13413\" srcset=\"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-1024x608.png 1024w, https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-300x178.png 300w, https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-768x456.png 768w, https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-1536x912.png 1536w, https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image.png 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Taking this process into account, it\u2019s not unlikely that ChatGPT could essentially learn to tick the compliance boxes for any and all compliance standards in the future.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It would, however, first need to be trained to understand every aspect of an organisation, from its security protocols, to its systems, products and personnel. More about this organisation-specific training later.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What is highly unlikely is that ChatGPT could identify shades of grey when it comes to compliance, especially because it may not be able to contextualise evidence within the parameters of specific situations and scenarios.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In addition, while an AI model such as ChatGPT could generate a report for an auditor, assimilate compliance knowledge, provide summaries and check for updates, will it be able to keep up with the ever-evolving field of compliance? The answer, is that \u2013 in the future &#8211; it probably could. Or rather ComplianceGPT (when it\u2019s invented) will probably be able to.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A compliance AI tool could be trained on an organisation\u2019s internal policies and procedures and provide advice and documentation to compliance officers within an organisation about regulations that apply to their company specifically.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, in theory, ChatGPT could one day do the basics of a compliance officer\u2019s job.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, like all things human and non-human, AI has its limitations.&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The limitations of ChatGPT\u202f&nbsp;<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Biases\u202f&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On February 2 2023, Open AI\u2019s CEO, Sam Altman, tweeted, \u201cWe know that ChatGPT has shortcomings around bias, and are working to improve it.\u201d&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to a <a href=\"https:\/\/www.businessinsider.com\/sam-altmans-chatgpt-has-a-bias-problem-that-could-get-it-canceled-2023-2?international=true&amp;r=US&amp;IR=T\" target=\"_blank\" rel=\"noreferrer noopener\">February 23 article<\/a> in Business Insider, ChatGPT needs to become more \u2018woke\u2019 because it\u2019s unlikely that companies will invest in technology that could cause them PR headaches.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How does Chat GPT\u2019s wokeness relate to its ability to take on the role of a compliance officer? Objectivity is one of the most important skills for compliance officers, and \u2013 naturally \u2013 auditors too.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This isn\u2019t to say that humans don\u2019t fall victim to bias. The difference is that a compliance officer who shows bias, will be held accountable, while an automaton may not be.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cCompliance officers are expected to provide an objective view of company policies. Influence by other employees, including management and executives, to overlook infractions may result in significant fines or sanctions that may lead to financial loss or even business closure.\u201d &#8211; Investopedia&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lack of common sense\u202f&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ChatGPT has no brain, no emotion, no history, no family. It has no morals or the ability to reason and understand. That means it lacks common sense.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We all need to learn through experience. When you\u2019re a toddler you\u2019ll happily put your hand on a stove plate because you haven\u2019t yet learnt that it could burn you. Once you\u2019ve learnt that you\u2019re likely to get hurt, it becomes common sense not to put your hand on the stove plate. Of course, you can develop common sense by learning from other people\u2019s experiences, but that requires the ability to reason and deduce &#8211; something that ChatGPT lacks.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Or does it?&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s do a quick test.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>We asked ChatGPT, \u201cIs it safe to leave a laptop open on a desk?\u201d&nbsp;<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And this is what it said:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Leaving a laptop open on a desk is generally safe as long as the desk is stable and the laptop is not in danger of being knocked over or exposed to other potential hazards. However, there are a few factors to consider that could affect the safety of leaving a laptop open on a desk:<\/em>&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em><strong>Security: <\/strong>If you are leaving your laptop unattended in a public place, it may not be safe from theft. It&#8217;s important to keep your laptop secure by locking it with a password or using a laptop lock.<\/em>&nbsp;<\/li>\n\n\n\n<li><em><strong>Temperature:<\/strong> Laptops generate heat when in use, and leaving a laptop on a desk for an extended period of time could cause it to overheat. Make sure the ventilation on the laptop is not blocked and the laptop is not placed in direct sunlight or near a source of heat.<\/em>&nbsp;<\/li>\n\n\n\n<li><em><strong>Power: <\/strong>If your laptop is not plugged into a power source, leaving it open on a desk for an extended period of time could cause the battery to drain, which could affect its performance and lifespan.<\/em>&nbsp;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>In summary, it is generally safe to leave a laptop open on a desk, but it&#8217;s important to consider security, temperature, and power issues before doing so.<\/em>&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>At no point did Chat GPT consider compliance, privacy and data security. A lack of common sense? Definitely.&nbsp;&nbsp;<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It should be noted that when specifically directed to consider compliance as part of the same scenario, Chat GPT\u2019s response was completely different and conformed to what would be expected as a response to a compliance-specific question.&nbsp;&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Inability to understand context\u202f&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In their article \u2018<a href=\"https:\/\/www.forbes.com\/sites\/bernardmarr\/2023\/03\/03\/the-top-10-limitations-of-chatgpt\/?sh=163383e8f355\" target=\"_blank\" rel=\"noreferrer noopener\">The Top 10 Limitations of Chat GPT\u2019<\/a>, Forbes explains that, \u201cChatGPT has difficulty understanding context, especially sarcasm and humor. While ChatGPT is proficient in language processing, it can struggle to grasp the subtle nuances of human communication. For example, if a user were to use sarcasm or humor in their message, ChatGPT may fail to pick up on the intended meaning and instead provide a response that is inappropriate or irrelevant.\u201d&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependence on training data\u202f&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Training data is used to train algorithms so that they can predict outcomes. As you can see from the diagram below, extracted from Cloud Factory\u2019s article \u201c<a href=\"https:\/\/www.cloudfactory.com\/training-data-guide\" target=\"_blank\" rel=\"noreferrer noopener\">The Essential Guide to Quality Training Data for Machine Learning\u201d,<\/a> when it comes to training data, there are multiple points at which human input is necessary.&nbsp;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"847\" src=\"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-1-1024x847.png\" alt=\"\" class=\"wp-image-13414\" srcset=\"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-1-1024x847.png 1024w, https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-1-300x248.png 300w, https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-1-768x635.png 768w, https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/image-1.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>This means that:&nbsp;<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"1\">\n<li>The AI depends on the accuracy of human input&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li>The AI cannot function without a human in the system&nbsp;&nbsp;<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">As with most things AI \u2013 and we saw this with the laptop example above &#8211; what you put in is what you get out. So, if the information and knowledge that is input by humans is inaccurate, untrue or of poor quality, then the output that the end user receives from the AI will similarly be inaccurate, untrue or of poor quality.&nbsp;&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Limited domain knowledge\u202f&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Domain knowledge refers to the intelligence one has about a specific area within a specific industry. So, essentially, domain knowledge = expertise. ChatGPT is not an expert in any particular field. This means that applying compliance within a specific domain will be difficult unless the user first trains Chat GPT to understand their industry, organisation or context.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This can be done, of course, but it would in fact be increasing the time taken to implement compliance frameworks, rather than increasing efficiency.&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">ChatGPT and GDPR: what do we know?\u202f&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Italy\u2019s data protection authority has ordered Open AI to stop processing people\u2019s data in Italy because it\u2019s concerned that Chat GPT is breaching the European Union\u2019s General Data Protection Regulation.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">According to the BBC, \u201cThe watchdog said on 20 March 2023 that the app had experienced a data breach involving user conversations and payment information.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It said there was no legal basis to justify &#8220;the mass collection and storage of personal data for the purpose of &#8216;training&#8217; the algorithms underlying the operation of the platform&#8221;.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It also said that since there was no way to verify the age of users, the app &#8220;exposes minors to absolutely unsuitable answers compared to their degree of development and awareness&#8221;.\u2019&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On the surface it does seem that Chat GPT is in breach of <a href=\"https:\/\/gdpr-info.eu\/art-5-gdpr\/\" target=\"_blank\" rel=\"noreferrer noopener\">key GDPR principles<\/a>, but judging by the lack on bandwagon-jumping, this could just be a knee-jerk reaction from Italy. The situation \u2013 as with anything AI \u2013 is ever-evolving.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>So, what exactly do we know about ChatGPT and GDPR?&nbsp;<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Purpose limitation\u202f&nbsp;<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">According to The Data Protection Commission, \u201cPersonal data should only be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.\u201d&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We\u2019ll have to keep an eye on what happens next in the Italy scenario to be able to know whether or not Open AI is practising purpose limitation as it should be.&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Separation of data\u202f&nbsp;<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Of vital concern for many organisations is the protection of data that is stored on shared systems. There are a number of reasons why this is important. One of them, of course, is regulatory compliance.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cBecause of the potential impact unauthorized access can have on a business, it is very important that organizations implement robust data segregation measures to limit access to sensitive data.\u201d \u2013 <a href=\"https:\/\/www.nextlabs.com\/why-is-data-segregation-important\/#:~:text=With%20systems%20potentially%20being%20shared,the%20authorization%20to%20access%20it.\" target=\"_blank\" rel=\"noreferrer noopener\">Next Labs.<\/a>&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Storage limitation\u202f&nbsp;<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Although ChatGPT itself doesn\u2019t control the data that is inputted and also doesn\u2019t have the ability to delete data, data that is used to train the AI is stored in large databases. The organisations that use the data to train Chat GPT claim that they may need to keep data for long periods of time for research or training purposes.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ChatGPT and ISO 27001: what to look out for?\u202f&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Access controls\u202f&nbsp;<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Subsection A.9.1 of ISO 27001 requires that an organisation has an Access Control Policy, defining which users have access to which networks and services.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At this stage Chat GPT wouldn\u2019t be able to perform this task unless it had been extensively trained on an organisation\u2019s access control protocols. Although it could churn out guidance, which would vary according to the tech startup\u2019s specific industry, about how to create the policy, it wouldn\u2019t be able to create the policy itself. This is because creating a comprehensive and effective access control policy requires a deep understanding of the specific business needs, risks, and regulatory requirements of a specific organisation. In fact, ChatGPT itself recommends that organisations engage with experienced information security professionals to create and implement an access control policy that is tailored to the specific needs of their organisation.&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Incident management\u202f&nbsp;<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">ISO 27001 defines a security incident as \u201can unwanted event that could endanger the confidentiality, integrity, or availability of information\u201d.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An incident can vary from fairly innocuous to extremely threatening for an organisation. Managing an incident requires not only a deep understanding of a particular organisation\u2019s assets, vulnerabilities and response procedure, but a sensitivity with regards to communication around the incident.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reporting procedures, post-incident reviews and improvement recommendations are best formulated by a professional person who has a complex understanding of the organisation involved.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Again, although ChatGPT can provide you with step-by-step instructions on what to do, unless it has been extensively trained in every aspect of your organisation, it won\u2019t be able to manage the incident or create accurate comms and reports around the incident.&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Monitoring and testing\u202f&nbsp;<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">When asked if it can perform ISO 27001 monitoring and testing, Chat GPT provided guidance and advice on monitoring and testing activities, including:&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vulnerability Scanning and Penetration Testing&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Access Control Testing&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Incident Response Testing&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Business Continuity Testing&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why ChatGPT is a bad fit for compliance, in general\u202f?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Compliance relies on an accurate and meticulous understanding of regulatory frameworks. It is inherently dependent on honest and exact inputs and outputs.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Open AI lists two of Chat GPT\u2019s limitations as:&nbsp;<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"1\">\n<li>ChatGPT sometimes writes plausible-sounding but incorrect or nonsensical answers\u2026&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li>The model is often excessively verbose \u2026&nbsp;<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">As a tech start-up you definitely don\u2019t need incorrect information when you head into your ISO 27001 audit and you also want to keep information as succinct and transparent as humanly (yes, humanly) possible.&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How you could use ChatGPT in compliance\u202f&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ChatGPT can give you the run-of-the-mill what-to-do and how-to-do-it of ISO 27001 compliance. What it can\u2019t do is create bespoke content for your compliance journey based on your organisation\u2019s specific information and needs.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With regards to AI, law professor Matthew Sag of Emory University says, \u201cThere&#8217;s a saying that an infinite number of monkeys will eventually give you Shakespeare.\u201d&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s important that we realise that Chat GPT is really just that (for now, anyway) \u2013 the result of an infinite amount of data from unknown sources being compiled into \u2018facts\u2019.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The results of this when it comes to compliance with standards such as ISO 27001 could be disastrous.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, it\u2019s advisable, if you\u2019re going to use Chat GPT or any other AI for compliance (or anything else for that matter), that you check and double check the content that the AI creates.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A better compliance journey awaits&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Could ChatGPT Compliance be the future of compliance? <\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Maybe.&nbsp;&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For now, while you could ostensibly use ChatGPT to create a generic roadmap for your ISO 27001 journey, there\u2019s already a tried-and-trusted tool (with accompanying directions) in existence\u2026 one that\u2019s been created by experts in the field of lean compliance.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>It\u2019s called Compleye Online and you can book a free demo <a href=\"https:\/\/compleye.io\/nl\/demo\/\">here!<\/a><\/strong><\/p>","protected":false},"excerpt":{"rendered":"<p>Love it or hate it, ChatGPT, and in fact, AI (Artificial Intelligence) in general is here to stay.&nbsp;&nbsp; All those in favour say AI should be seen as a tool that can be used to make organisations and individuals more efficient, while all those against wonder if we are falling [&hellip;]<\/p>","protected":false},"author":17,"featured_media":13415,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[100,79],"tags":[],"class_list":["post-13411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-gdpr","category-iso27001"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>ChatGPT and Compliance | Can you trust Compliance answers?<\/title>\n<meta name=\"description\" content=\"ChatGPT can give you the run-of-the-mill what-to-do and how-to-do-it of ISO 27001 compliance. We have the tips.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/compleye.io\/nl\/artikelen\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/\" \/>\n<meta property=\"og:locale\" content=\"nl_NL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ChatGPT and Compliance | Can you trust Compliance answers?\" \/>\n<meta property=\"og:description\" content=\"ChatGPT can give you the run-of-the-mill what-to-do and how-to-do-it of ISO 27001 compliance. We have the tips.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/compleye.io\/nl\/artikelen\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/\" \/>\n<meta property=\"og:site_name\" content=\"compleye.io\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-06T08:34:56+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-06-26T07:34:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/Screenshot-2023-04-06-at-10.34.25-1024x451.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"451\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Karolin Kruiskamp\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Geschreven door\" \/>\n\t<meta name=\"twitter:data1\" content=\"Karolin Kruiskamp\" \/>\n\t<meta name=\"twitter:label2\" content=\"Geschatte leestijd\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":[\"Article\",\"BlogPosting\"],\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/\"},\"author\":{\"name\":\"Karolin Kruiskamp\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#\\\/schema\\\/person\\\/0cec6d61467336a3c2ea74f0beb84bc3\"},\"headline\":\"The Risks of Using AI Tools like ChatGPT in ISO 27001 Compliance: What To Look Out For\u00a0\u00a0\",\"datePublished\":\"2023-04-06T08:34:56+00:00\",\"dateModified\":\"2023-06-26T07:34:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/\"},\"wordCount\":2633,\"publisher\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/Screenshot-2023-04-06-at-10.34.25.png\",\"articleSection\":[\"GDPR\",\"ISO27001\"],\"inLanguage\":\"nl-NL\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/\",\"url\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/\",\"name\":\"ChatGPT and Compliance | Can you trust Compliance answers?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/Screenshot-2023-04-06-at-10.34.25.png\",\"datePublished\":\"2023-04-06T08:34:56+00:00\",\"dateModified\":\"2023-06-26T07:34:48+00:00\",\"description\":\"ChatGPT can give you the run-of-the-mill what-to-do and how-to-do-it of ISO 27001 compliance. We have the tips.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/#breadcrumb\"},\"inLanguage\":\"nl-NL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/#primaryimage\",\"url\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/Screenshot-2023-04-06-at-10.34.25.png\",\"contentUrl\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/Screenshot-2023-04-06-at-10.34.25.png\",\"width\":2560,\"height\":1128,\"caption\":\"Chat PGT & Compleye\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/compleye.io\\\/articles\\\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/compleye.io\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Risks of Using AI Tools like ChatGPT in ISO 27001 Compliance: What To Look Out For\u00a0\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#website\",\"url\":\"https:\\\/\\\/compleye.io\\\/\",\"name\":\"compleye.io\",\"description\":\"security and privacy compliance getting done\",\"publisher\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/compleye.io\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"nl-NL\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#organization\",\"name\":\"Compleye\",\"url\":\"https:\\\/\\\/compleye.io\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Compleye_Logo_Logo_Black.png\",\"contentUrl\":\"https:\\\/\\\/compleye.io\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Compleye_Logo_Logo_Black.png\",\"width\":2451,\"height\":892,\"caption\":\"Compleye\"},\"image\":{\"@id\":\"https:\\\/\\\/compleye.io\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/c-board\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCpe1Z7aynfqWSrjgJORgKXw\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/compleye.io\\\/#\\\/schema\\\/person\\\/0cec6d61467336a3c2ea74f0beb84bc3\",\"name\":\"Karolin Kruiskamp\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"nl-NL\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g\",\"caption\":\"Karolin Kruiskamp\"},\"url\":\"https:\\\/\\\/compleye.io\\\/nl\\\/articles\\\/author\\\/karolin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ChatGPT and Compliance | Can you trust Compliance answers?","description":"ChatGPT can give you the run-of-the-mill what-to-do and how-to-do-it of ISO 27001 compliance. We have the tips.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/compleye.io\/nl\/artikelen\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/","og_locale":"nl_NL","og_type":"article","og_title":"ChatGPT and Compliance | Can you trust Compliance answers?","og_description":"ChatGPT can give you the run-of-the-mill what-to-do and how-to-do-it of ISO 27001 compliance. We have the tips.","og_url":"https:\/\/compleye.io\/nl\/artikelen\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/","og_site_name":"compleye.io","article_published_time":"2023-04-06T08:34:56+00:00","article_modified_time":"2023-06-26T07:34:48+00:00","og_image":[{"width":1024,"height":451,"url":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/Screenshot-2023-04-06-at-10.34.25-1024x451.png","type":"image\/png"}],"author":"Karolin Kruiskamp","twitter_card":"summary_large_image","twitter_misc":{"Geschreven door":"Karolin Kruiskamp","Geschatte leestijd":"12 minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":["Article","BlogPosting"],"@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/#article","isPartOf":{"@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/"},"author":{"name":"Karolin Kruiskamp","@id":"https:\/\/compleye.io\/#\/schema\/person\/0cec6d61467336a3c2ea74f0beb84bc3"},"headline":"The Risks of Using AI Tools like ChatGPT in ISO 27001 Compliance: What To Look Out For\u00a0\u00a0","datePublished":"2023-04-06T08:34:56+00:00","dateModified":"2023-06-26T07:34:48+00:00","mainEntityOfPage":{"@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/"},"wordCount":2633,"publisher":{"@id":"https:\/\/compleye.io\/#organization"},"image":{"@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/#primaryimage"},"thumbnailUrl":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/Screenshot-2023-04-06-at-10.34.25.png","articleSection":["GDPR","ISO27001"],"inLanguage":"nl-NL"},{"@type":"WebPage","@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/","url":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/","name":"ChatGPT and Compliance | Can you trust Compliance answers?","isPartOf":{"@id":"https:\/\/compleye.io\/#website"},"primaryImageOfPage":{"@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/#primaryimage"},"image":{"@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/#primaryimage"},"thumbnailUrl":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/Screenshot-2023-04-06-at-10.34.25.png","datePublished":"2023-04-06T08:34:56+00:00","dateModified":"2023-06-26T07:34:48+00:00","description":"ChatGPT can give you the run-of-the-mill what-to-do and how-to-do-it of ISO 27001 compliance. We have the tips.","breadcrumb":{"@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/#breadcrumb"},"inLanguage":"nl-NL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/"]}]},{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/#primaryimage","url":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/Screenshot-2023-04-06-at-10.34.25.png","contentUrl":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/04\/Screenshot-2023-04-06-at-10.34.25.png","width":2560,"height":1128,"caption":"Chat PGT & Compleye"},{"@type":"BreadcrumbList","@id":"https:\/\/compleye.io\/articles\/the-risks-of-using-ai-tools-like-chatgpt-in-iso-27001-compliance-what-to-look-out-for\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/compleye.io\/"},{"@type":"ListItem","position":2,"name":"The Risks of Using AI Tools like ChatGPT in ISO 27001 Compliance: What To Look Out For\u00a0\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/compleye.io\/#website","url":"https:\/\/compleye.io\/","name":"compleye.io","description":"security and privacy compliance getting done","publisher":{"@id":"https:\/\/compleye.io\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/compleye.io\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"nl-NL"},{"@type":"Organization","@id":"https:\/\/compleye.io\/#organization","name":"Compleye","url":"https:\/\/compleye.io\/","logo":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/compleye.io\/#\/schema\/logo\/image\/","url":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/03\/Compleye_Logo_Logo_Black.png","contentUrl":"https:\/\/compleye.io\/wp-content\/uploads\/2023\/03\/Compleye_Logo_Logo_Black.png","width":2451,"height":892,"caption":"Compleye"},"image":{"@id":"https:\/\/compleye.io\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/c-board\/","https:\/\/www.youtube.com\/channel\/UCpe1Z7aynfqWSrjgJORgKXw"]},{"@type":"Person","@id":"https:\/\/compleye.io\/#\/schema\/person\/0cec6d61467336a3c2ea74f0beb84bc3","name":"Karolin Kruiskamp","image":{"@type":"ImageObject","inLanguage":"nl-NL","@id":"https:\/\/secure.gravatar.com\/avatar\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e9c574805c26ff058e494916fb42a856824ea78280afec8044becfcbddce78c7?s=96&d=mm&r=g","caption":"Karolin Kruiskamp"},"url":"https:\/\/compleye.io\/nl\/articles\/author\/karolin\/"}]}},"_links":{"self":[{"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/posts\/13411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/comments?post=13411"}],"version-history":[{"count":4,"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/posts\/13411\/revisions"}],"predecessor-version":[{"id":13418,"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/posts\/13411\/revisions\/13418"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/media\/13415"}],"wp:attachment":[{"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/media?parent=13411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/categories?post=13411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/compleye.io\/nl\/wp-json\/wp\/v2\/tags?post=13411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}