# Which AI standard are we following? A gap assessment for operators When the board asks which AI standard the company follows, an oil, gas or chemical operator has three candidates: IOGP Report 817-1 (IOGP's principles for responsible AI), DNV-RP-0671 and ISO/IEC 42001, often called ISO 42001. Each covers part of the ground, and none of them covers the site's own safety management system. XO Autonomous Operations assesses your AI governance against all three and against that system, and give the board one answer with the gaps ranked. ## What do IOGP 817-1, DNV-RP-0671 and ISO/IEC 42001 each cover? | | [IOGP Report 817-1](https://idms.iogp.org/Documents/1359) | [DNV-RP-0671](https://www.dnv.com/digital-trust/recommended-practices/assurance-of-ai-enabled-systems-dnv-rp-0671/) | [ISO/IEC 42001:2023](https://www.iso.org/standard/42001) | |---|---|---|---| | Type | Industry principles with guidelines for implementation | Recommended practice | International management system standard | | Published | April 2026 | Not stated on DNV's page | December 2023 | | What it covers | Responsible use of AI in the industry, including decision-making transparency, regulatory compliance, operational safety and governance structures | A governance framework for assuring that AI-enabled systems are trustworthy and managed responsibly throughout their life cycle, with a practical interpretation of the EU AI Act | Requirements for establishing, implementing, maintaining and continually improving an AI management system | | Unit of attention | The company's use of AI | Each AI-enabled system, validated continuously | The organisation that develops, provides or uses AI | ## What does none of them cover? Your site's safety management system. In XO's reading, none of the three tells you how your own process safety elements absorb AI. When a vendor retrains the model behind a maintenance deferral, does your [management of change](https://www.autonomous-operations.ai/ai-management-of-change/) procedure catch it? An AI advisory in the control room now supports a barrier, so that barrier needs a performance standard and an owner who knows the model is part of it. Operators need the [competence](https://www.autonomous-operations.ai/operator-competence-ai/) to question the model and to run the plant without it. Optimisation has to stay inside [operating limits](https://www.autonomous-operations.ai/ai-operating-limits/) the model cannot override. These questions sit in the elements the site already runs. The [hub page](https://www.autonomous-operations.ai/ai-process-safety-management/) maps them element by element. You may also hear of EN 18286:2026. It is the first harmonised standard under the AI Act, a quality management system for providers of high-risk AI, with its reference published by [Implementing Decision (EU) 2026/2274](https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj) in the Official Journal of 14 October 2026. The dates that matter for operators are on [EU AI Act and Machinery Regulation dates](https://www.autonomous-operations.ai/eu-ai-act-machinery-regulation-dates/). ## Who owns AI governance on a high-hazard site? Usually two people. The AI compliance or responsible AI role, where one exists, tends to sit in legal, data or IT and owns the AI policy, the register and the EU AI Act file. The safety management system stays with operations and HSE. Where AI reaches a decision about the hazardous process, the SMS owner decides how it is controlled: management of change, barriers, competence and operating limits. The two need one register and one route for changes and incidents. What the SMS owner needs from the AI Act owner is set out on [AI in process safety management](https://www.autonomous-operations.ai/ai-process-safety-management/#if-you-own-the-ai-act-file-and-not-the-safety-management-system). ## What does the gap assessment deliver? The scope is the AI your sites use or plan to use, including tools staff adopted without approval. XO reviews your AI policy, register and risk assessments and the relevant safety management system elements, interview the owners, and check use on site. You receive a matrix of each requirement from the three documents against your existing system, sorted into the three outcomes of the [M-OPS OMI framework](https://www.autonomous-operations.ai/omi/): already controlled, needs modifying, or a new element needed. The board gets a one-page answer stating which document you follow for what, and the gaps ranked with owners and actions. The fee is quoted for each engagement and agreed in writing before work starts. You can start with an [autonomous operations briefing](https://www.autonomous-operations.ai/#how-do-i-work-the-m-ops-service-range), credited in full against the assessment. ## Can an AI specialist join our internal or HSE audit? Yes. Board members often put the standards question to internal audit first, and the audit then needs questions its protocol does not hold. What was the model trained on, and what can it not see? Who changed it last, and did that change go through management of change? Can operators still run the process without it? Your team leads and owns the report. XO prepares the AI lines of enquiry with you, takes part in interviews, document review and field checks, and drafts the findings on the AI scope for your team to adopt, on site or remotely. ## Who carries out the work? Carl Goodwin, founder of XO Autonomous Operations, scopes, conducts and leads each mission himself. He was a senior operational risk auditor at bp from December 2011 to February 2019 across upstream, downstream, including refineries, and chemicals, and the subject matter expert for control of work and for operating limits. He has carried out more than 50 management system audits and improvement plans in over 20 countries. He also ran sites, as deputy general manager of the In Amenas gas processing joint venture in Algeria and as acting site manager of an upper-tier Seveso polymer plant. He holds the PECB ISO/IEC 42001 Foundation certificate. To scope an assessment or an audit, [get in touch](https://www.autonomous-operations.ai/contact/). ## What you can expect from XO Autonomous Operations - A matrix of each requirement of IOGP 817-1, DNV-RP-0671 and ISO/IEC 42001 against your existing system. - A one-page answer for the board on which document you follow for what. - The gaps ranked, with owners and actions. - For an internal or HSE audit: the AI lines of enquiry, interviews, field checks and draft findings on the AI scope.