Accountability

AI-related objective: The organization can identify who is responsible for the AI system and its outcomes, demonstrates that it acts responsibly and can answer for decisions the system contributes to. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4). Read accountability against the objective the use threatens most.

What it asks

AI-related objective: The organization can identify who is responsible for the AI system and its outcomes, demonstrates that it acts responsibly and can answer for decisions the system contributes to. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4).

Where generative AI changes the answer

Accountability for generative AI has to survive the handover from the team that bought the tool to the team that now depends on its output.

Reading it in practice

Accountability for generative AI has to survive three handovers: from the team that bought the tool, to the team that depends on it, to the person who acts on its output. The evidence is a named owner at each handover and a record that the third person knew what they were relying on. A RACI chart with no names does not evidence any of it.

Who it binds

The AI risk owner, with the objective owner named in the risk treatment plan. For A.2 the named role is the owner of named accountability per AI system.

Evidence an auditor normally samples

• Named accountability per AI system

The test you can run

Take named accountability per AI system and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Decisions attributed to 'the algorithm' with no accountable person

Before the draft publishes

For A.2, pick the two objectives the use most affects, write the test you would apply, and record the result before the draft is published. The first artefact to produce is named accountability per AI system.

Where this sits against the draft

A.2 carries the annex a: ai-related objectives part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on A.2 (accountability) with this record and note the change in the register.