Requirement
"The organization shall specify and document requirements for new AI systems or material enhancements to existing systems."[1]
Explanation
Before building a new AI system or making a significant change to one, the organization must write down why the system is being built and what it has to do. Auditors look for documented requirements covering the whole life cycle — proof that development decisions trace back to a stated rationale rather than improvisation.
Implementation Guidance
- The organization should document the rationale for developing an AI system and its goals. Some of the factors that should be considered, documented and understood can include:
- a) why the AI system is to be developed, for example, is this driven by a business case, customer request or by government policy;
- b) how the model can be trained and how data requirements can be achieved.
- AI system requirements should be specified and should span the entire AI system life cycle. Such requirements should be revisited in cases where the developed AI system is unable to operate as intended or new information arises that can be used to change and to improve the requirements. For instance, it can become unfeasible from a financial perspective to develop the AI system.
- Other information: The processes for describing the AI system life cycle are provided by ISO/IEC 5338. For more information about human-centred design for interactive systems, see ISO 9241-210.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.6.2.2
- ISO/IEC 42001:2023 Annex B, B.6.2.2 (implementation guidance)
