AI system requirements and specification

Write down the requirements for any new AI system and for any material enhancement of an existing one. The artefact behind the answer is requirements specification spanning the life cycle. For ai system requirements and specification the evidence sits at the gate it belongs to.

What it asks

Write down the requirements for any new AI system and for any material enhancement of an existing one.

Where generative AI changes the answer

Requirements for a generative system have to include what it must refuse and how it signals uncertainty, not only what it must produce.

Who it binds

The AI system owner and the delivery team at each life cycle gate. For A.6.2.2 the named role is the owner of requirements specification spanning the life cycle.

Evidence an auditor normally samples

• Requirements specification spanning the life cycle
• Documented rationale and goals (business case, customer request, policy)
• Records of requirements revisited when the system cannot operate as intended

The test you can run

Ask for requirements specification spanning the life cycle and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Rationale for building the system undocumented
• Requirements never revisited after feasibility changes

Before the draft publishes

For A.6.2.2, walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first. The first artefact to produce is requirements specification spanning the life cycle.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.6.2.2 (ai system requirements and specification) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.