Requirement
"The organization shall ensure that the AI system is used according to the intended uses of the AI system and its accompanying documentation."[1]
Explanation
AI systems must be operated the way their documentation says they should be — right deployment instructions, right data, human oversight where required, monitored in operation. Auditors look for event logs and records demonstrating use stayed within intended purposes, and evidence that concerns about off-label use are escalated.
Implementation Guidance
- The AI system should be deployed according to the instructions and other documentation associated with the AI system (see B.8.2). The deployment can require specific resources to support the deployment, including the need to ensure that human oversight is applied as required (see B.9.3). It can be necessary that for acceptable use of the AI system, the data that the AI system is used on aligns with the documentation associated with the AI system to ensure that the AI system performance is accurate.
- The operation of the AI system should be monitored (see B.6.2.6). Where the correct deployment of the AI system according to its associated instructions causes concern regarding the impact to relevant interested parties or the organization's legal requirements, the organization should communicate its concerns to the relevant personnel inside the organization as well as to any third-party suppliers of the AI system.
- The organization should keep event logs or other documentation related to the deployment and operation of the AI system which can be used to demonstrate that the AI system is being used as intended or to help with communicating concerns related to the intended use of the AI system. The time period during which event logs and other documentation are kept depends on the intended use of the AI system, the organization's data retention policies and relevant legal requirements for data retention.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.9.4
- ISO/IEC 42001:2023 Annex B, B.9.4 (implementation guidance)
