Requirement
"The organization shall provide capabilities for interested parties to report adverse impacts of the AI system."[1]
Explanation
This control requires a working channel — such as a reporting form, hotline, or contact address — through which users and other outsiders can flag harm caused by the AI system, like unfair outcomes. Auditors check the channel exists, is reachable by external parties, and that reports actually arrive somewhere the organization monitors.
Implementation Guidance
- While the system operation should be monitored for reported issues and failures, the organization should also provide capabilities for users or other external parties to report adverse impacts (e.g. unfairness).
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.8.3
- ISO/IEC 42001:2023 Annex B, B.8.3 (implementation guidance)
