# A.6.2.2 AI system requirements and specification

Write down the requirements for any new AI system and for any material enhancement of an existing one. The artefact behind the answer is requirements specification spanning the life cycle. For ai system requirements and specification the evidence sits at the gate it belongs to.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.6.2.2
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Write down the requirements for any new AI system and for any material enhancement of an existing one.

## Where generative AI changes the answer

Requirements for a generative system have to include what it must refuse and how it signals uncertainty, not only what it must produce.

## Who it binds

The AI system owner and the delivery team at each life cycle gate.

## Evidence an auditor samples

- Requirements specification spanning the life cycle
- Documented rationale and goals (business case, customer request, policy)
- Records of requirements revisited when the system cannot operate as intended

## The test you can run

Ask for the verification record and the deployment decision, and check that the second refers to the first.

## Common failures

- Rationale for building the system undocumented
- Requirements never revisited after feasibility changes

## Before the draft publishes

Walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.