Requirement
"The organization shall identify and document objectives to guide the responsible development AI systems, and take those objectives into account and integrate measures to achieve them in the development life cycle."[1]
Explanation
This control asks the organization to spell out what responsible AI development means for it — objectives such as fairness, safety, or security — and to build concrete measures for meeting them into each development stage. An auditor looks for documented objectives and evidence they actually shaped requirements, data handling, training, and testing.
Implementation Guidance
- The organization should identify objectives (see 6.2) that affect the AI system design and development processes. These objectives should be taken into account in the design and development processes. For example, if an organization defines "fairness" as one objective, this should be incorporated in the requirements specification, data acquisition, data conditioning, model training, verification and validation, etc. The organization should provide requirements and guidelines as necessary to ensure that measures are integrated into the various stages (e.g. the requirement to use a specific testing tool or method to address unfairness or unwanted bias) to achieve such objectives.
- Other information: AI techniques are being used to augment security measures such as threat prediction detection and prevention of security attacks. This is an application of AI techniques that can be used to reinforce security measures to protect both AI systems and conventional non-AI based software systems. Annex C provides examples of organizational objectives for managing risk, which can be useful in determining the objectives for AI system development.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.6.1.2
- ISO/IEC 42001:2023 Annex B, B.6.1.2 (implementation guidance)
