# A.6.2.6 AI system operation and monitoring

Define and document what the AI system needs for ongoing operation, which at a minimum means monitoring of the system and its performance, repair, updating and support. The artefact behind the answer is operating procedures covering monitoring, repair, update and support. For ai system operation and monitoring the evidence sits at the gate it belongs to.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.6.2.6
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Define and document what the AI system needs for ongoing operation, which at a minimum means monitoring of the system and its performance, repair, updating and support.

## Where generative AI changes the answer

Operation and monitoring has to detect a vendor model change, a shift in the corpus and a rise in bad outputs, none of which alerts by default.

## Who it binds

The AI system owner and the delivery team at each life cycle gate.

## Evidence an auditor samples

- Operating procedures covering monitoring, repair, update and support
- Performance monitoring on production data including drift and continuous learning checks
- Update process with user communication
- Identification of AI-specific security threats in operation

## The test you can run

Ask for the verification record and the deployment decision, and check that the second refers to the first.

## Common failures

- Drift not monitored
- Updates pushed without informing users
- Use beyond the designed purpose not reviewed

## Before the draft publishes

Walk the use through the life cycle gates and record which gate has no evidence behind it. That gap is what an auditor will ask about first.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.