# A.10.4 Customers

Make sure the organization's responsible approach to developing and using AI systems takes account of its customers' expectations and needs. What an auditor asks for is record of customer expectations and needs (requirements, contracts, usage agreements). For customers the evidence is the contract and the notice it produced.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.10.4
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Make sure the organization's responsible approach to developing and using AI systems takes account of its customers' expectations and needs.

## Where generative AI changes the answer

Customer expectations for generative AI include knowing when an answer was machine-produced and what it should not be used for, and those expectations belong in the contract.

## Who it binds

The procurement or supplier manager and the AI system owner.

## Evidence an auditor samples

- Record of customer expectations and needs (requirements, contracts, usage agreements)
- Allocation of responsibilities between provider and customer
- Information given to customers to treat their risks, including domain-of-use limits

## The test you can run

Ask for the contract clause on model change notice, and for the last notice received.

## Common failures

- Customer expectations never captured
- Domain-of-use limits not communicated to customers

## Before the draft publishes

Read one supplier contract for what happens when the model changes, who owns the output and who is told about an incident.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.