Customers

Make sure the organization's responsible approach to developing and using AI systems takes account of its customers' expectations and needs. What an auditor asks for is record of customer expectations and needs (requirements, contracts, usage agreements). For customers the evidence is the contract and the notice it produced.

What it asks

Make sure the organization's responsible approach to developing and using AI systems takes account of its customers' expectations and needs.

Where generative AI changes the answer

Customer expectations for generative AI include knowing when an answer was machine-produced and what it should not be used for, and those expectations belong in the contract.

Who it binds

The procurement or supplier manager and the AI system owner. For A.10.4 the named role is the owner of record of customer expectations and needs (requirements, contracts, usage agreements).

Evidence an auditor normally samples

• Record of customer expectations and needs (requirements, contracts, usage agreements)
• Allocation of responsibilities between provider and customer
• Information given to customers to treat their risks, including domain-of-use limits

The test you can run

Take record of customer expectations and needs (requirements, contracts, usage agreements) and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Customer expectations never captured
• Domain-of-use limits not communicated to customers

Before the draft publishes

For A.10.4, read one supplier contract for what happens when the model changes, who owns the output and who is told about an incident. The first artefact to produce is record of customer expectations and needs (requirements, contracts, usage agreements).

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.10.4 (customers) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.