Establishing communication and consultation

The organization settles and approves how it will communicate and consult in support of the framework (ISO 31000:2018, 5.4.5). In practice the record is communication and consultation plan naming AI-affected stakeholders. Test it on the 5.4.5 question at the next framework review.

What it asks

The organization settles and approves how it will communicate and consult in support of the framework (ISO 31000:2018, 5.4.5). For AI that approach has to reach the extra stakeholders AI brings in, such as data subjects and people subject to automated decisions, convey the organization's responsible-AI policies and commitments, and collect those people's views on harms, benefits and the oversight they expect.

Where generative AI changes the answer

Staff need a route to report a wrong or harmful output that does not require them to know whether it counts as an incident.

Who it binds

Top management, the AI risk owner and the functions that supply resources and communication. For 5.4.5 the named role is the owner of communication and consultation plan naming AI-affected stakeholders.

Evidence an auditor normally samples

• Communication and consultation plan naming AI-affected stakeholders

The test you can run

Compare communication and consultation plan naming AI-affected stakeholders with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Communication limited to internal teams with affected people never consulted

Before the draft publishes

For 5.4.5, check that the use appears in the framework at all, with a named owner, a resource line and a route to raise a concern. Add the missing one. The first artefact to produce is communication and consultation plan naming AI-affected stakeholders.

Where this sits against the draft

5.4.5 carries the framework: leadership, integration and improvement part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 5.4.5 (establishing communication and consultation) with this record and note the change in the register.