Requirement
"The organization shall ensure that responsibilities within their AI system life cycle are allocated between the organization, its partners, suppliers, customers and third parties."[1]
Explanation
AI systems are rarely built and run by one party — data providers, model vendors, developers and users all play a part. This control requires documenting every party in the AI life cycle and assigning responsibility for each role, so an auditor can confirm no accountability gaps exist between the organization, its suppliers, partners and customers.
Implementation Guidance
- In an AI system life cycle, responsibilities can be split between parties providing data, parties providing algorithms and models, parties developing or using the AI system and being accountable with regard to some or all interested parties. The organization should document all parties intervening in the AI system life cycle and their roles and determine their responsibilities.
- Where the organization supplies an AI system to a third party, the organization should ensure that it takes a responsible approach to developing the AI system. See the controls and guidance in B.6. The organization should be able to provide the necessary documentation (see B.6.2.7 and B.8.2) for the AI system to relevant interested parties and to the third party that the organization is supplying the AI system to.
- When processed data includes PII, responsibilities are usually split between PII processors and controllers. ISO/IEC 29100 provides further information on PII controllers and PII processors. Where the privacy of PII is to be preserved, controls such as those described in ISO/IEC 27701 should be considered. Based on the organization's and AI system's data processing activities on PII and the organization's role in application and development of the AI system through their life cycle, the organization can take on the role of a PII controller (or joint PII controller), PII processor or both.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.10.2
- ISO/IEC 42001:2023 Annex B, B.10.2 (implementation guidance)
