Requirement
"Roles and responsibilities for AI shall be defined and allocated according to the needs of the organization."[1]
Explanation
Clear ownership is the backbone of AI accountability: someone must be answerable for risk management, impact assessments, security, privacy, oversight, and data quality across each AI system's life cycle. An auditor will ask for a documented roles-and-responsibilities allocation — typically a role matrix — and check that assignments cover the areas the AI policy and risk assessments identify.
Implementation Guidance
- Defining roles and responsibilities is critical for ensuring accountability throughout the organization for its role with respect to the AI system throughout its life cycle. The organization should consider AI policies, AI objectives and identified risks when assigning roles and responsibilities, in order to ensure that all relevant areas are covered. The organization can prioritize how the roles and responsibilities are assigned. Examples of areas that can require defined roles and responsibilities can include:
- risk management;
- AI system impact assessments;
- asset and resource management;
- security;
- safety;
- privacy;
- development;
- performance;
- human oversight;
- supplier relationships;
- demonstrate its ability to consistently fulfil legal requirements;
- data quality management (during the whole life cycle).
- Responsibilities of the various roles should be defined to the level appropriate for the individuals to perform their duties.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.3.2
- ISO/IEC 42001:2023 Annex B, B.3.2 (implementation guidance)
