# A.10.2 Allocating responsibilities

Make sure responsibilities across the AI system life cycle are divided among the organization, its suppliers, partners, customers and other third parties. What an auditor asks for is register of all parties in the AI system life cycle with their roles and responsibilities. For allocating responsibilities the evidence is the contract and the notice it produced.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.10.2
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Make sure responsibilities across the AI system life cycle are divided among the organization, its suppliers, partners, customers and other third parties.

## Where generative AI changes the answer

Responsibility for a generative AI output has to be allocated across the organisation, the model supplier, the integration partner and the customer, and the allocation has to reach the person who acts on the answer.

## Who it binds

The procurement or supplier manager and the AI system owner.

## Evidence an auditor samples

- Register of all parties in the AI system life cycle with their roles and responsibilities
- Contract clauses allocating responsibilities
- PII controller and processor determination where PII is processed

## The test you can run

Ask for the contract clause on model change notice, and for the last notice received.

## Common failures

- Data providers and model providers missing from the allocation
- PII roles not determined

## Before the draft publishes

Read one supplier contract for what happens when the model changes, who owns the output and who is told about an incident.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.