# A.9.4 Intended use of the AI system

Make sure the AI system is used in line with its intended uses and its accompanying documentation. In practice the record is deployment evidence following system instructions and documentation. For intended use of the ai system the evidence is what people did, not what they were told.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.9.4
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Make sure the AI system is used in line with its intended uses and its accompanying documentation.

## Where generative AI changes the answer

Intended use has to exclude the uses the system was not built for, and those exclusions have to reach the people who could attempt them.

## Who it binds

The business owner of the use and the people who act on the output.

## Evidence an auditor samples

- Deployment evidence following system instructions and documentation
- Checks that input data match documented conditions
- Event logs demonstrating use as intended
- Records of concerns raised internally and to suppliers

## The test you can run

Ask for one logged exception to the acceptable-use rule, and for what was done about it.

## Common failures

- System used on data outside its documented domain
- No logs to show use as intended

## Before the draft publishes

Write the acceptable-use rule in the words staff use, publish it where they work, and record the first exception it produces.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.