Home / Requirement record / A.3
A.3
AI expertise
AI-related objective: The organization has, or can obtain, the expertise in AI, data and the application domain that developing, deploying and using its AI systems responsibly requires. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4). Read ai expertise against the objective the use threatens most.
- What it asks
- AI-related objective: The organization has, or can obtain, the expertise in AI, data and the application domain that developing, deploying and using its AI systems responsibly requires. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4).
- Where generative AI changes the answer
- The expertise that matters is not only model engineering: it is knowing what a good output looks like in the domain where it is used.
- Reading it in practice
- AI expertise for a generative system is domain expertise as much as model expertise. The person who can tell a good output from a confident wrong one is usually the practitioner whose work the system supports. The evidence is a competence record that names those people, their training and the cases they were tested on, not a course completion count.
- Who it binds
- The AI risk owner, with the objective owner named in the risk treatment plan. For A.3 the named role is the owner of competence records for AI roles.
- Evidence an auditor normally samples
- Competence records for AI roles
- The test you can run
- Take competence records for AI roles and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.
- Common failures
- AI systems procured and run with no in-house understanding
- Before the draft publishes
- For A.3, pick the two objectives the use most affects, write the test you would apply, and record the result before the draft is published. The first artefact to produce is competence records for AI roles.
- Where this sits against the draft
- A.3 carries the annex a: ai-related objectives part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on A.3 (ai expertise) with this record and note the change in the register.