Requirement
"The organization shall determine and document their obligations to reporting information about the AI system to interested parties."[1]
Explanation
Regulators, customers, and other outside parties may be entitled to information about an AI system — technical documentation, risk details, impact assessment results, or logs. Auditors want these reporting obligations identified and written down, with evidence the organization knows which jurisdictions apply and shares the right information with the right authorities on time.
Implementation Guidance
- In some cases, a jurisdiction can require information about the system to be shared with authorities such as regulators. Information can be reported to interested parties such as customers or regulatory authorities within the appropriate timeframe.
- The information shared can include, for example:
- technical system documentation, including, but not limited, to data sets for training, validation and testing as well as algorithmic choices justifications and verification and validation records;
- risks related to the system;
- results of impact assessments;
- logs and other system records.
- The organization should understand their obligations in this respect and ensure that the appropriate information is shared with the correct authorities. Additionally, it is presupposed that the organization is aware of jurisdictional requirements related to information shared with law enforcement authorities.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.8.5
- ISO/IEC 42001:2023 Annex B, B.8.5 (implementation guidance)
