System documentation and information for users

Determine what information users of the AI system need and provide it. In practice the record is user information covering purpose, that the user is dealing with AI, how to interact and override, technical requirements and limitations, human oversight needs, accuracy and performance, relevant impact assessment findings, benefit claim revisions, updates, contacts and training material. For system documentation and information for users the test is what a reader outside the team understands.

What it asks

Determine what information users of the AI system need and provide it.

Where generative AI changes the answer

User documentation has to state the limits of the system in the user's terms, including the cases where its answer should not be relied on.

Who it binds

The AI system owner and the communications or customer function. For A.8.2 the named role is the owner of user information covering purpose, that the user is dealing with AI, how to interact and override, technical requirements and limitations, human oversight needs, accuracy and performance, relevant impact assessment findings, benefit claim revisions, updates, contacts and training material.

Evidence an auditor normally samples

• User information covering purpose, that the user is dealing with AI, how to interact and override, technical requirements and limitations, human oversight needs, accuracy and performance, relevant impact assessment findings, benefit claim revisions, updates, contacts and training material
• Documented criteria for deciding what information is given
• Validation that users can access complete, current information

The test you can run

Compare user information covering purpose, that the user is dealing with AI, how to interact and override, technical requirements and limitations, human oversight needs, accuracy and performance, relevant impact assessment findings, benefit claim revisions, updates, contacts and training material with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Users not told they are interacting with AI
• No criteria for what information users receive
• Information not kept current after updates

Before the draft publishes

For A.8.2, read the user-facing statement as a customer would, and check that it names the limits of the system rather than its features. The first artefact to produce is user information covering purpose, that the user is dealing with AI, how to interact and override, technical requirements and limitations, human oversight needs, accuracy and performance, relevant impact assessment findings, benefit claim revisions, updates, contacts and training material.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.8.2 (system documentation and information for users) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.