Requirement
"The organization shall document a deployment plan and ensure that appropriate requirements are met prior to deployment."[1]
Explanation
Moving an AI system into production must follow a documented deployment plan, with defined release requirements — passed verification, met performance metrics, management sign-off — satisfied first. Auditors check that the plan accounts for differences between development and production environments and considers the people the system will affect.
Implementation Guidance
- AI systems can be developed in various environments and deployed in others (such as developed on premises and deployed using cloud computing) and the organization should take these differences into account for the deployment plan. The organization should also consider whether components are deployed separately (e.g. software and model can be deployed independently). Additionally, the organization should have a set of requirements to be met prior to release and deployment (sometimes referred to as "release criteria"). This can include verification and validation measures that are to be passed, performance metrics that are to be met, user testing to be completed, as well as management approvals and sign-offs to be obtained. The deployment plan should take into account the perspectives of and impacts to relevant interested parties.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.6.2.5
- ISO/IEC 42001:2023 Annex B, B.6.2.5 (implementation guidance)
