# A.8.3 External reporting

Give interested parties a way to tell the organization about harmful effects of the AI system. In practice the record is external channel for users and other parties to report adverse impacts such as unfairness. For external reporting the test is what a reader outside the team understands.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.8.3
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Give interested parties a way to tell the organization about harmful effects of the AI system.

## Where generative AI changes the answer

External reporting covers the regulator and the customer, and the statement has to be true of the system as deployed, not as designed.

## Who it binds

The AI system owner and the communications or customer function.

## Evidence an auditor samples

- External channel for users and other parties to report adverse impacts such as unfairness
- Log of external reports and their handling

## The test you can run

Ask a customer-facing colleague to explain the system limits. Compare that with the published statement.

## Common failures

- Only internal monitoring, no external reporting route

## Before the draft publishes

Read the user-facing statement as a customer would, and check that it names the limits of the system rather than its features.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.