Information for interested parties

Identify and record what the organization is obliged to tell interested parties about the AI system. In practice the record is register of obligations to report AI system information to regulators, customers and others, with timeframes. For information for interested parties the test is what a reader outside the team understands.

What it asks

Identify and record what the organization is obliged to tell interested parties about the AI system.

Where generative AI changes the answer

Information for interested parties includes the fact that generative AI is in use, which many organisations still do not disclose.

Who it binds

The AI system owner and the communications or customer function. For A.8.5 the named role is the owner of register of obligations to report AI system information to regulators, customers and others, with timeframes.

Evidence an auditor normally samples

• Register of obligations to report AI system information to regulators, customers and others, with timeframes
• Records of information shared (technical documentation, risks, impact assessment results, logs)

The test you can run

Compare register of obligations to report AI system information to regulators, customers and others, with timeframes with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Regulatory reporting duties for AI systems not identified
• Law enforcement information requests not addressed

Before the draft publishes

For A.8.5, read the user-facing statement as a customer would, and check that it names the limits of the system rather than its features. The first artefact to produce is register of obligations to report AI system information to regulators, customers and others, with timeframes.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.8.5 (information for interested parties) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.