ISO/IEC 42001:2023 A.6.2.4 AI system verification and validation

Requirement

"The organization shall define and document verification and validation measures for the AI system and specify criteria for their use."[1]

Explanation

The organization must decide in advance how it will prove an AI system works — test methods, test data, release criteria — and what evaluation the system must pass, including checks on impacts to people. Auditors expect documented criteria and evidence the system was evaluated against them before release.

Implementation Guidance

• The verification and validation measures can include, but are not limited to:
  • testing methodologies and tools;
  • selection of test data and their representation of the intended domain of use;
  • release criteria requirements.
• The organization should define and document evaluation criteria such as, but not limited to:
  • a plan to evaluate the AI system components and the whole AI system for risks related to impacts on individuals or groups of individuals, or both, and societies;
  • the evaluation plan can be based on, for example:
    • reliability and safety requirements of the AI system, including acceptable error rates for the AI system performance;
    • responsible AI system development and use objectives such as those in B.6.1.2 and B.9.3;
    • operational factors such as quality of data, intended use, including acceptable ranges of each operational factor;
    • any intended uses which can require more rigorous operational factors to be defined, including different acceptable ranges for operational factors or lower error rates;
  • the methods, guidance or metrics to be used to evaluate whether relevant interested parties who make decisions or are subject to decisions based on the AI system outputs can adequately interpret the AI system outputs. The frequency of evaluation should be determined and can be based upon results from an AI system impact assessment;
  • any acceptable factors that can account for an inability to meet a target minimum performance level, especially when the AI system is evaluated for impacts on individuals or groups of individuals, or both, and societies (e.g. poor image resolution for computer vision systems or background noise affecting speech recognition systems). Mechanisms to deal with poor AI system performance as a result of these factors should also be documented.
• The AI system should be evaluated against the documented criteria for evaluation.
• Where the AI system cannot meet the documented criteria for evaluation, especially against responsible AI system development and use objectives (see B.6.1.2 and B.9.3), the organization should reconsider or manage the deficiencies of the intended use of the AI system, its performance requirements and how the organization can effectively address the impacts to individuals or groups of individuals, or both, and societies.
• NOTE: Further information on how to deal with robustness of neural networks can be found in ISO/IEC TR 24029-1.

References

1. ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.6.2.4
2. ISO/IEC 42001:2023 Annex B, B.6.2.4 (implementation guidance)