# A.6.2.5 AI system deployment

Document a deployment plan and make sure the appropriate requirements are met before deployment. The artefact behind the answer is deployment plan addressing development and deployment environments and separately deployed components. For ai system deployment the evidence sits at the gate it belongs to.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.6.2.5
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Document a deployment plan and make sure the appropriate requirements are met before deployment.

## Where generative AI changes the answer

Deployment is where a pilot becomes a dependency, so the conditions for use and the rollback have to be agreed before the first real user.

## Who it binds

The AI system owner and the delivery team at each life cycle gate.

## Evidence an auditor samples

- Deployment plan addressing development and deployment environments and separately deployed components
- Release criteria met (V&V passed, metrics achieved, user testing, management sign-off)
- Consideration of interested parties' perspectives

## The test you can run

Ask for the verification record and the deployment decision, and check that the second refers to the first.

## Common failures

- Deployed without documented release criteria
- Model and software deployed separately without joint checks

## Before the draft publishes

Walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.