# A.3.3 Reporting of concerns

Define and operate a process for people to raise concerns about what the organization does in relation to an AI system at any point in its life cycle. In practice the record is concern reporting procedure with confidential or anonymous options. For reporting of concerns a team name is not a person, so write the name.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.3.3
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Define and operate a process for people to raise concerns about what the organization does in relation to an AI system at any point in its life cycle.

## Where generative AI changes the answer

A reporting route for concerns has to work for a wrong answer as well as for misconduct, and the person reporting rarely knows which category it is.

## Who it binds

Top management and the named AI roles.

## Evidence an auditor samples

- Concern reporting procedure with confidential or anonymous options
- Promotion of the channel to staff and contractors
- Investigation and escalation records and response times
- Anti-reprisal protections

## The test you can run

Ask who can switch the system off. If the answer is a team rather than a person, the control is not assigned.

## Common failures

- Channel exists but is unknown to contractors
- No protection from reprisal
- Reports not escalated to management

## Before the draft publishes

Name the person who can approve a use, the person who owns the output and the person who can switch the system off. If one name is missing, that is the finding.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.