Annex A.10
ISO 42001
INFRASTRUCTURE
AI System Management
Description
Covers ongoing AI system management including impact assessment updates, version control, documentation maintenance, and system performance review processes.
Controls
| ID | Control | Description |
|---|---|---|
| A.10.1 | AI system impact re-assessment | Periodic re-evaluation of AI system impacts as context, usage, or system capabilities change over time. |
| A.10.2 | AI system version control | Management of AI system versions including models, training data, code, and configurations with traceability and rollbac... |
| A.10.3 | AI system documentation maintenance | Ongoing maintenance of AI system documentation to reflect current state, changes, and operational learnings. |
Implementation Guidance
Establish triggers for impact re-assessment (significant model updates, usage expansion, regulatory changes, incidents) with documented review process. Implement model registry with versioning for all AI artifacts (models, datasets, feature engineering code, configs) and deployment tracking. Maintain living documentation (model cards, system cards, operational runbooks) with change logs and regular review cycles ensuring accuracy.
Evidence Requirements
Impact re-assessment schedules and reports
Model registry with version history
Documentation update logs
System configuration management records