Allocating responsibilities

Make sure responsibilities across the AI system life cycle are divided among the organization, its suppliers, partners, customers and other third parties. What an auditor asks for is register of all parties in the AI system life cycle with their roles and responsibilities. For allocating responsibilities the evidence is the contract and the notice it produced.

What it asks

Make sure responsibilities across the AI system life cycle are divided among the organization, its suppliers, partners, customers and other third parties.

Where generative AI changes the answer

Responsibility for a generative AI output has to be allocated across the organisation, the model supplier, the integration partner and the customer, and the allocation has to reach the person who acts on the answer.

Who it binds

The procurement or supplier manager and the AI system owner. For A.10.2 the named role is the owner of register of all parties in the AI system life cycle with their roles and responsibilities.

Evidence an auditor normally samples

• Register of all parties in the AI system life cycle with their roles and responsibilities
• Contract clauses allocating responsibilities
• PII controller and processor determination where PII is processed

The test you can run

Take register of all parties in the AI system life cycle with their roles and responsibilities and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Data providers and model providers missing from the allocation
• PII roles not determined

Before the draft publishes

For A.10.2, read one supplier contract for what happens when the model changes, who owns the output and who is told about an incident. The first artefact to produce is register of all parties in the AI system life cycle with their roles and responsibilities.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.10.2 (allocating responsibilities) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.