Requirement
"The organization shall define and document the specific processes for the responsible design and development of the AI system."[1]
Explanation
Beyond stating objectives, the organization must define the actual processes used to design and build AI systems responsibly — covering life cycle stages, testing, human oversight, impact assessment timing, training data rules, approvals, and change control. Auditors expect these processes written down, not improvised project by project.
Implementation Guidance
- Responsible development for AI system processes should include consideration of, without limitation, the following:
- life cycle stages (a generic AI system life cycle model is provided by ISO/IEC 22989, but the organization can specify their own life cycle stages);
- testing requirements and planned means for testing;
- human oversight requirements, including processes and tools, especially when the AI system can impact natural persons;
- at what stages AI system impact assessments should be performed;
- training data expectations and rules (e.g. what data can be used, approved data suppliers and labelling);
- expertise (subject matter domain or other) required or training for developers of AI systems or both;
- release criteria;
- approvals and sign-offs necessary at various stages;
- change control;
- usability and controllability;
- engagement of interested parties.
- The specific design and development processes depend on the functionality and the AI technologies that are intended to be used for the AI system.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.6.1.3
- ISO/IEC 42001:2023 Annex B, B.6.1.3 (implementation guidance)
