Home / Requirement record / A.7
A.7
Maintainability
AI-related objective: The AI system can be maintained, updated and corrected over its life, including retraining, without losing the properties it was assessed for. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4). The artefact behind the answer is maintenance and update procedures with re-validation. Read maintainability against the objective the use threatens most.
- What it asks
- AI-related objective: The AI system can be maintained, updated and corrected over its life, including retraining, without losing the properties it was assessed for. Used when establishing risk criteria (6.3.4), identifying consequences (6.4.2.6) and evaluating risk (6.4.4).
- Where generative AI changes the answer
- Maintainability asks whether the organisation can still explain and repair the system after the vendor changes the model underneath it.
- Reading it in practice
- Maintainability asks whether the organisation can still explain and repair the system after the vendor changes the model. The evidence is the version record, the change notice clause and the re-test that followed the last change. If the organisation cannot say which model version produced an output last quarter, maintainability is not evidenced.
- Who it binds
- The AI risk owner, with the objective owner named in the risk treatment plan. For A.7 the named role is the owner of maintenance and update procedures with re-validation.
- Evidence an auditor normally samples
- Maintenance and update procedures with re-validation
- The test you can run
- Take maintenance and update procedures with re-validation and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.
- Common failures
- Model updates that bypass re-assessment
- Before the draft publishes
- For A.7, pick the two objectives the use most affects, write the test you would apply, and record the result before the draft is published. The first artefact to produce is maintenance and update procedures with re-validation.
- Where this sits against the draft
- A.7 carries the annex a: ai-related objectives part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on A.7 (maintainability) with this record and note the change in the register.