Requirement
"The organization shall determine and provide the necessary information to users of the AI system."[1]
Explanation
Users can only trust and safely operate an AI system if they know they are dealing with one, what it is for, and where its limits lie. Auditors look for documented criteria on what information users receive — purpose, limitations, oversight needs, contact routes — and evidence the material is accessible, current, and accurate.
Implementation Guidance
- Information about the AI system can include both technical details and instructions, as well as general notifications to users that they are interacting with an AI system, depending on the context. This can also include the system itself, as well as potential outputs of the system (e.g. notifying users that an image is created by AI).
- Although AI systems can be complex, it is critical that users are able to understand when they are interacting with an AI system, how the system works. Users also need to understand its intended purpose and intended uses, its potential to cause harm or benefit the user. Some system documentation can necessarily be targeted for more technical uses (e.g. system administrators), and the organization should understand the needs of different interested parties and what understandability can mean to them. The information should also be accessible, both in terms of ease of use in finding it, as well as for users who can need additional accessibility features.
- Information that can be provided to users include, but are not limited to:
- purpose of the system;
- that the user is interacting with an AI system;
- how to interact with the system;
- how and when to override the system;
- technical requirements for system operation, including the computational resources needed, and limitations of the system as well as its expected lifetime;
- needs for human oversight;
- information about accuracy and performance;
- relevant information from the impact assessment, including potential benefits and harms, particularly if they are applicable in specific contexts or certain demographic groups (see B.5.2 and B.5.4);
- revisions to claims about the system's benefits;
- updates and changes in how the system works, as well as any necessary maintenance measures, including their frequency;
- contact information;
- educational materials for system use.
- Criteria used by the organization to determine whether and what information is to be provided should be documented. Relevant criteria include but are not limited to the intended use and reasonably foreseeable misuse of the AI system, the expertise of the user and specific impact of the AI system.
- Information can be provided to users in numerous ways, including documented instructions for use, alerts and other notifications built into the system itself, information on a web page, etc. Depending on which methods the organization uses to provide information, it should validate that the users have access to this information, and that the information provided is complete, up to date and accurate.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.8.2
- ISO/IEC 42001:2023 Annex B, B.8.2 (implementation guidance)
