Requirement
"The organization shall document the AI system design and development based on organizational objectives, documented requirements and specification criteria."[1]
Explanation
Every AI system embodies design choices — the learning approach, the model type, training data, security defences, how people interact with it. This control requires those choices to be written down against the documented requirements, ending in final system architecture documentation an auditor can follow from objective to implemented design.
Implementation Guidance
- There are many design choices necessary for an AI system, including, but not limited to:
- machine learning approach (e.g. supervised vs. unsupervised);
- learning algorithm and type of machine learning model utilized;
- how the model is intended to be trained and which data quality (see B.7);
- evaluation and refinement of models;
- hardware and software components;
- security threats considered throughout the AI system life cycle; security threats specific to AI systems include data poisoning, model stealing or model inversion attacks;
- interface and presentation of outputs;
- how humans can interact with the system;
- interoperability and portability considerations.
- There can be multiple iterations between design and development, but documentation on the stage should be maintained and a final system architecture documentation should be available.
- Other information: For more information about human-centred design for interactive systems, see ISO 9241-210.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.6.2.3
- ISO/IEC 42001:2023 Annex B, B.6.2.3 (implementation guidance)
