External reporting

Give interested parties a way to tell the organization about harmful effects of the AI system. In practice the record is external channel for users and other parties to report adverse impacts such as unfairness. For external reporting the test is what a reader outside the team understands.

What it asks

Give interested parties a way to tell the organization about harmful effects of the AI system.

Where generative AI changes the answer

External reporting covers the regulator and the customer, and the statement has to be true of the system as deployed, not as designed.

Who it binds

The AI system owner and the communications or customer function. For A.8.3 the named role is the owner of external channel for users and other parties to report adverse impacts such as unfairness.

Evidence an auditor normally samples

• External channel for users and other parties to report adverse impacts such as unfairness
• Log of external reports and their handling

The test you can run

Compare external channel for users and other parties to report adverse impacts such as unfairness with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Only internal monitoring, no external reporting route

Before the draft publishes

For A.8.3, read the user-facing statement as a customer would, and check that it names the limits of the system rather than its features. The first artefact to produce is external channel for users and other parties to report adverse impacts such as unfairness.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.8.3 (external reporting) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.