Processes for responsible design and development of AI systems

Set down in writing the particular processes the organization follows to design and build the AI system responsibly. The artefact behind the answer is documented development process covering life cycle stages, testing, human oversight requirements, impact assessment points, training data rules, developer expertise, release criteria, approvals, change control, usability and controllability and stakeholder engagement. For processes for responsible design and development of ai systems the evidence sits at the gate it belongs to.

What it asks

Set down in writing the particular processes the organization follows to design and build the AI system responsibly.

Where generative AI changes the answer

The process has to reach the prompt design and the retrieval configuration, because those choices decide the risk as much as the model does.

Reading it in practice

The process for responsible design has to reach the prompt and the retrieval configuration, because those choices decide the behaviour as much as the model does. The evidence is a design record that states the intended use, the excluded uses, the test that shows the boundary and the person who approved it.

Who it binds

The AI system owner and the delivery team at each life cycle gate. For A.6.1.3 the named role is the owner of documented development process covering life cycle stages, testing, human oversight requirements, impact assessment points, training data rules, developer expertise, release criteria, approvals, change control, usability and controllability and stakeholder engagement.

Evidence an auditor normally samples

• Documented development process covering life cycle stages, testing, human oversight requirements, impact assessment points, training data rules, developer expertise, release criteria, approvals, change control, usability and controllability and stakeholder engagement

The test you can run

Ask for documented development process covering life cycle stages, testing, human oversight requirements, impact assessment points, training data rules, developer expertise, release criteria, approvals, change control, usability and controllability and stakeholder engagement and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• No release criteria or sign-off gates
• Human oversight requirements not defined at design

Before the draft publishes

For A.6.1.3, walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first. The first artefact to produce is documented development process covering life cycle stages, testing, human oversight requirements, impact assessment points, training data rules, developer expertise, release criteria, approvals, change control, usability and controllability and stakeholder engagement.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.6.1.3 (processes for responsible design and development of ai systems) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.