AI system verification and validation

Set out in writing how the AI system will be verified and validated and the criteria that govern when each measure is used. The artefact behind the answer is V&V plan with test methods, tools, representative test data and release criteria. For ai system verification and validation the evidence sits at the gate it belongs to.

What it asks

Set out in writing how the AI system will be verified and validated and the criteria that govern when each measure is used.

Where generative AI changes the answer

Verification has to include adversarial input, because a generative system passes the demonstration and fails the attack.

Who it binds

The AI system owner and the delivery team at each life cycle gate. For A.6.2.4 the named role is the owner of V&V plan with test methods, tools, representative test data and release criteria.

Evidence an auditor normally samples

• V&V plan with test methods, tools, representative test data and release criteria
• Evaluation criteria including impacts on individuals and societies, reliability and safety requirements with acceptable error rates, responsible AI objectives and operational factor ranges
• Evaluation results and handling of unmet criteria

The test you can run

Ask for V&V plan with test methods, tools, representative test data and release criteria and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Test data not representative of the domain of use
• No acceptable error rates defined
• Failing criteria accepted without reconsidering intended use

Before the draft publishes

For A.6.2.4, walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first. The first artefact to produce is V&V plan with test methods, tools, representative test data and release criteria.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.6.2.4 (ai system verification and validation) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.