Requirement
"As part of resource identification, the organization shall document information about the human resources and their competences utilized for the development, deployment, operation, change management, maintenance, transfer and decommissioning, as well as verification and integration of the AI system."[1]
Explanation
AI systems depend on people — data scientists, oversight roles, and safety, security, and privacy experts — across development, operation, maintenance, and decommissioning. The organization must document who these people are and what competences they hold. Auditors read this record to confirm the right expertise, including diverse expertise, actually backs each life cycle stage.
Implementation Guidance
- The organization should consider the need for diverse expertise and include the types of roles necessary for the system. For example, the organization can include specific demographic groups related to data sets used to train machine learning models, if their inclusion is a necessary component of the system design. Necessary human resources can include but are not limited to:
- data scientists;
- roles related to human oversight of AI systems;
- experts on trustworthiness topics such as safety, security and privacy;
- AI researchers and specialists, and domain experts relevant to the AI systems.
- Different resources can be necessary at different stages of the AI system life cycle.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.4.6
- ISO/IEC 42001:2023 Annex B, B.4.6 (implementation guidance)
