# A.3.2 AI roles and responsibilities

Define and allocate AI roles and responsibilities according to the organization's needs. In practice the record is AI roles and responsibilities matrix. For ai roles and responsibilities a team name is not a person, so write the name.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.3.2
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Define and allocate AI roles and responsibilities according to the organization's needs.

## Where generative AI changes the answer

Generative AI roles have to name who approves a use, who owns the output and who can switch the system off, because the vendor owns none of those.

## Who it binds

Top management and the named AI roles.

## Evidence an auditor samples

- AI roles and responsibilities matrix
- Coverage of human oversight, security, privacy, safety, performance, development, suppliers, legal compliance, data quality, assets and resources, impact assessment and risk management
- Evidence roles were assigned considering policy, objectives and risks

## The test you can run

Ask who can switch the system off. If the answer is a team rather than a person, the control is not assigned.

## Common failures

- No role owns human oversight
- Data quality responsibility undefined across the life cycle

## Before the draft publishes

Name the person who can approve a use, the person who owns the output and the person who can switch the system off. If one name is missing, that is the finding.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.