Requirement
"The organization shall identify and document objectives to guide the responsible use of AI systems."[1]
Explanation
The organization must write down what responsible AI use means for it — objectives such as fairness, transparency, safety, and privacy — and put mechanisms in place to achieve them, including human oversight. Auditors expect documented objectives and evidence they actually shape decisions about which AI systems are used and how.
Implementation Guidance
- The organization operating in different contexts can have different expectations and objectives for what constitutes the responsible development of AI systems. Depending on its context, the organization should identify its objectives related to responsible use. Some objectives include:
- fairness;
- accountability;
- transparency;
- explainability;
- reliability;
- safety;
- robustness and redundancy;
- privacy and security;
- accessibility.
- Once defined, the organization should implement mechanisms to achieve its objectives within the organization. This can include determining if a third-party solution fulfils the organization's objectives or if an internally developed solution is applicable for the intended use. The organization should determine at which stages of the AI system life cycle meaningful human oversight objectives should be incorporated. This can include:
- involving human reviewers to check the outputs of the AI system, including having authority to override decisions made by the AI system;
- ensuring that human oversight is included if required for acceptable use of the AI system according to instructions or other documentation associated with the intended deployment of the AI system;
- monitoring the performance of the AI system, including the accuracy of the AI system outputs;
- reporting concerns related to the outputs of the AI system and their impact to relevant interested parties;
- reporting concerns with changes in the performance or ability of the AI system to make correct outputs on the production data;
- considering whether automated decision-making is appropriate for a responsible approach to the use of an AI system and the intended use of the AI system.
- The need for human oversight can be informed by the AI system impact assessments (see B.5). The personnel involved in human oversight activities related to the AI system should be informed of, trained and understand the instructions and other documentation to the AI system and the duties they carry out to satisfy human oversight objectives. When reporting performance issues, human oversight can augment automated monitoring.
- Other information: Annex C provides examples of organizational objectives for managing risk, which can be useful in determining the objectives for AI system use.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.9.3
- ISO/IEC 42001:2023 Annex B, B.9.3 (implementation guidance)
