# A.7 Maintainability

AI-related objective: The AI system can be maintained, updated and corrected over its life, including retraining, without losing the properties it was assessed for. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4). The artefact behind the answer is maintenance and update procedures with re-validation. Read maintainability against the objective the use threatens most.

- Framework: ISO/IEC 23894:2023
- Cited to: ISO/IEC 23894:2023, clause A.7
- Source: https://www.iso.org/standard/77304.html
- Last updated: 2026-10-20

## What it asks

AI-related objective: The AI system can be maintained, updated and corrected over its life, including retraining, without losing the properties it was assessed for. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4).

## Where generative AI changes the answer

Maintainability asks whether the organisation can still explain and repair the system after the vendor changes the model underneath it.

## Who it binds

The AI risk owner, with the objective owner named in the risk treatment plan.

## Evidence an auditor samples

- Maintenance and update procedures with re-validation

## The test you can run

Ask which objective the use threatens most and what measure shows it. A blank answer is the finding.

## Common failures

- Model updates that bypass re-assessment

## Before the draft publishes

Pick the two objectives the use most affects, write the test you would apply, and record the result before the draft is published.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.