# A.8.5 Information for interested parties

Identify and record what the organization is obliged to tell interested parties about the AI system. In practice the record is register of obligations to report AI system information to regulators, customers and others, with timeframes. For information for interested parties the test is what a reader outside the team understands.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.8.5
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Identify and record what the organization is obliged to tell interested parties about the AI system.

## Where generative AI changes the answer

Information for interested parties includes the fact that generative AI is in use, which many organisations still do not disclose.

## Who it binds

The AI system owner and the communications or customer function.

## Evidence an auditor samples

- Register of obligations to report AI system information to regulators, customers and others, with timeframes
- Records of information shared (technical documentation, risks, impact assessment results, logs)

## The test you can run

Ask a customer-facing colleague to explain the system limits. Compare that with the published statement.

## Common failures

- Regulatory reporting duties for AI systems not identified
- Law enforcement information requests not addressed

## Before the draft publishes

Read the user-facing statement as a customer would, and check that it names the limits of the system rather than its features.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.