# A.6.2.4 AI system verification and validation

Set out in writing how the AI system will be verified and validated and the criteria that govern when each measure is used. The artefact behind the answer is V&V plan with test methods, tools, representative test data and release criteria. For ai system verification and validation the evidence sits at the gate it belongs to.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.6.2.4
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Set out in writing how the AI system will be verified and validated and the criteria that govern when each measure is used.

## Where generative AI changes the answer

Verification has to include adversarial input, because a generative system passes the demonstration and fails the attack.

## Who it binds

The AI system owner and the delivery team at each life cycle gate.

## Evidence an auditor samples

- V&V plan with test methods, tools, representative test data and release criteria
- Evaluation criteria including impacts on individuals and societies, reliability and safety requirements with acceptable error rates, responsible AI objectives and operational factor ranges
- Evaluation results and handling of unmet criteria

## The test you can run

Ask for the verification record and the deployment decision, and check that the second refers to the first.

## Common failures

- Test data not representative of the domain of use
- No acceptable error rates defined
- Failing criteria accepted without reconsidering intended use

## Before the draft publishes

Walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.