# A.9.2 Processes for responsible use of AI systems

Set out in writing how the organization makes sure AI systems are used responsibly. In practice the record is documented responsible use process covering approvals, cost including monitoring and maintenance, approved sourcing requirements and applicable legal requirements. For processes for responsible use of ai systems the evidence is what people did, not what they were told.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.9.2
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Set out in writing how the organization makes sure AI systems are used responsibly.

## Where generative AI changes the answer

Responsible use starts with the acceptable-use rule and the route by which a new use is approved, because most use arrives without one.

## Who it binds

The business owner of the use and the people who act on the output.

## Evidence an auditor samples

- Documented responsible use process covering approvals, cost including monitoring and maintenance, approved sourcing requirements and applicable legal requirements
- Evidence the process applies to internally built and third-party systems

## The test you can run

Ask for one logged exception to the acceptable-use rule, and for what was done about it.

## Common failures

- Staff adopt AI tools without any approval
- Ongoing monitoring cost ignored in adoption decisions

## Before the draft publishes

Write the acceptable-use rule in the words staff use, publish it where they work, and record the first exception it produces.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.