Processes for responsible use of AI systems

Set out in writing how the organization makes sure AI systems are used responsibly. In practice the record is documented responsible use process covering approvals, cost including monitoring and maintenance, approved sourcing requirements and applicable legal requirements. For processes for responsible use of ai systems the evidence is what people did, not what they were told.

What it asks

Set out in writing how the organization makes sure AI systems are used responsibly.

Where generative AI changes the answer

Responsible use starts with the acceptable-use rule and the route by which a new use is approved, because most use arrives without one.

Who it binds

The business owner of the use and the people who act on the output. For A.9.2 the named role is the owner of documented responsible use process covering approvals, cost including monitoring and maintenance, approved sourcing requirements and applicable legal requirements.

Evidence an auditor normally samples

• Documented responsible use process covering approvals, cost including monitoring and maintenance, approved sourcing requirements and applicable legal requirements
• Evidence the process applies to internally built and third-party systems

The test you can run

Compare documented responsible use process covering approvals, cost including monitoring and maintenance, approved sourcing requirements and applicable legal requirements with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Staff adopt AI tools without any approval
• Ongoing monitoring cost ignored in adoption decisions

Before the draft publishes

For A.9.2, write the acceptable-use rule in the words staff use, publish it where they work, and record the first exception it produces. The first artefact to produce is documented responsible use process covering approvals, cost including monitoring and maintenance, approved sourcing requirements and applicable legal requirements.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.9.2 (processes for responsible use of ai systems) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.