AI system deployment

Document a deployment plan and make sure the appropriate requirements are met before deployment. The artefact behind the answer is deployment plan addressing development and deployment environments and separately deployed components. For ai system deployment the evidence sits at the gate it belongs to.

What it asks

Document a deployment plan and make sure the appropriate requirements are met before deployment.

Where generative AI changes the answer

Deployment is where a pilot becomes a dependency, so the conditions for use and the rollback have to be agreed before the first real user.

Who it binds

The AI system owner and the delivery team at each life cycle gate. For A.6.2.5 the named role is the owner of deployment plan addressing development and deployment environments and separately deployed components.

Evidence an auditor normally samples

• Deployment plan addressing development and deployment environments and separately deployed components
• Release criteria met (V&V passed, metrics achieved, user testing, management sign-off)
• Consideration of interested parties' perspectives

The test you can run

Ask for deployment plan addressing development and deployment environments and separately deployed components and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Deployed without documented release criteria
• Model and software deployed separately without joint checks

Before the draft publishes

For A.6.2.5, walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first. The first artefact to produce is deployment plan addressing development and deployment environments and separately deployed components.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.6.2.5 (ai system deployment) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.