# A.6.2.3 Documentation of AI system design and development

Document the AI system's design and development, grounded in the organization's objectives, the documented requirements and the specification criteria. The artefact behind the answer is design records covering ML approach, algorithm and model type, training approach and data quality, evaluation and refinement, hardware and software, AI-specific security threats, output interface, human interaction and interoperability. For documentation of ai system design and development the evidence sits at the gate it belongs to.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.6.2.3
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Document the AI system's design and development, grounded in the organization's objectives, the documented requirements and the specification criteria.

## Where generative AI changes the answer

Design documentation has to record the model version, the system prompt and the corpus, or the behaviour cannot be reproduced later.

## Who it binds

The AI system owner and the delivery team at each life cycle gate.

## Evidence an auditor samples

- Design records covering ML approach, algorithm and model type, training approach and data quality, evaluation and refinement, hardware and software, AI-specific security threats, output interface, human interaction and interoperability
- Final system architecture documentation

## The test you can run

Ask for the verification record and the deployment decision, and check that the second refers to the first.

## Common failures

- AI-specific threats such as data poisoning, model inversion and model theft not considered
- No final architecture documentation

## Before the draft publishes

Walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.