# A.3 AI expertise

AI-related objective: The organization has, or can obtain, the expertise in AI, data and the application domain that developing, deploying and using its AI systems responsibly requires. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4). Read ai expertise against the objective the use threatens most.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause A.3
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

AI-related objective: The organization has, or can obtain, the expertise in AI, data and the application domain that developing, deploying and using its AI systems responsibly requires. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4).

## Where generative AI changes the answer

The expertise that matters is not only model engineering: it is knowing what a good output looks like in the domain where it is used.

## Who it binds

The AI risk owner, with the objective owner named in the risk treatment plan.

## Evidence an auditor samples

- Competence records for AI roles

## The test you can run

Ask which objective the use threatens most and what measure shows it. A blank answer is the finding.

## Common failures

- AI systems procured and run with no in-house understanding

## Before the draft publishes

Pick the two objectives the use most affects, write the test you would apply, and record the result before the draft is published.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.