Requirement
"The organization shall define and put in place a process to report concerns about the organization's role with respect to an AI system throughout its life cycle."[1]
Explanation
Employees and contractors need a safe, known channel to raise concerns about how the organization builds or uses AI — with confidentiality, anonymity, protection from reprisal, and timely investigation. Auditors look for a defined reporting process with qualified staff, escalation to management, and evidence that concerns are handled; an existing whistleblowing mechanism can serve if it covers AI.
Implementation Guidance
- The reporting mechanism should fulfil the following functions:
- a) options for confidentiality or anonymity or both;
- b) available and promoted to employed and contracted persons;
- c) staffed with qualified persons;
- d) stipulates appropriate investigation and resolution powers for the persons referred to in c);
- e) provides for mechanisms to report and to escalate to management in a timely manner;
- f) provides for effective protection from reprisals for both the persons concerned with reporting and investigation (e.g. by allowing reports to be made anonymously and confidentially);
- g) provides reports according to 4.4 and, if appropriate, e); while maintaining confidentiality and anonymity in a), and respecting general business confidentiality considerations;
- h) provides response mechanisms within an appropriate time frame.
- NOTE: The organization can utilize existing reporting mechanisms as part of this process.
- Other information: In addition to the implementation guidance provided in this clause, the organization should further consider ISO 37002.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.3.3
- ISO/IEC 42001:2023 Annex B, B.3.3 (implementation guidance)
