Requirement
"The organization shall define and document the processes for the responsible use of AI systems."[1]
Explanation
This control asks the organization to spell out how AI systems may be used responsibly — covering approvals, cost, sourcing, and legal requirements — whether systems are built in-house or bought. An auditor looks for documented processes showing use decisions follow defined policy rather than ad-hoc judgment.
Implementation Guidance
- Depending on its context, the organization can have many considerations for determining whether to use a particular AI system. Whether the AI system is developed by the organization itself or sourced from a third party, the organization should be clear on what these considerations are and develop policies to address them. Some examples are:
- required approvals;
- cost (including for ongoing monitoring and maintenance);
- approved sourcing requirements;
- legal requirements applicable to the organization.
- Where the organization has accepted policies for the use of other systems, assets, etc., these policies can be incorporated if desired.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.9.2
- ISO/IEC 42001:2023 Annex B, B.9.2 (implementation guidance)
