Communication and consultation

Communication and consultation help stakeholders understand risk, the basis for decisions and the reasons for actions, and should happen throughout the process (ISO 31000:2018, 6.2); for AI the organization should involve and inform the stakeholders an AI system affects, including those newly introduced by its use, and should communicate its policies and commitments on AI risk so that the views gathered inform fairness criteria, oversight and transparency. The step before 6.2 supplies its input, so run both together.

What it asks

Communication and consultation help stakeholders understand risk, the basis for decisions and the reasons for actions, and should happen throughout the process (ISO 31000:2018, 6.2); for AI the organization should involve and inform the stakeholders an AI system affects, including those newly introduced by its use, and should communicate its policies and commitments on AI risk so that the views gathered inform fairness criteria, oversight and transparency.

Where generative AI changes the answer

The people who face the risk include the customers whose data is in the prompt and the people whose work the output describes, not only the system's users.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.2 the named role is the owner of records of consultation with AI-affected stakeholders during the process.

Evidence an auditor normally samples

• Records of consultation with AI-affected stakeholders during the process

The test you can run

Take records of consultation with AI-affected stakeholders during the process and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Stakeholders informed after deployment rather than consulted before

Before the draft publishes

For 6.2, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is records of consultation with AI-affected stakeholders during the process.

Where this sits against the draft

6.2 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.2 (communication and consultation) with this record and note the change in the register.