Annex A.3
ISO 42001
GOVERNANCE
Internal Organization
Description
Addresses organizational structure for AI governance, including role definition, segregation of duties, accountability assignment, and establishment of AI ethics oversight.
Controls
| ID | Control | Description |
|---|---|---|
| A.3.1 | AI roles and responsibilities | Defined and communicated roles for AI development, deployment, governance, and oversight with clear authorities and acco... |
| A.3.2 | Segregation of duties for AI systems | Separation of conflicting responsibilities in AI lifecycle (development, testing, approval, monitoring) to prevent confl... |
| A.3.3 | Accountability for AI system decisions | Clear assignment of accountability for AI system design, decisions, outcomes, and impacts to specific individuals or tea... |
| A.3.4 | AI ethics oversight | Established AI ethics board or committee with authority to review high-risk AI systems and resolve ethical concerns. |
Implementation Guidance
Establish AI governance structure with executive sponsorship, dedicated AI risk management roles, and cross-functional ethics committee. Define role matrix (RACI) for AI lifecycle activities ensuring separation between developers and validators. Document clear accountability chains for AI decisions, from data scientists to business owners to executive oversight.
Evidence Requirements
Organization charts showing AI governance structure
Role descriptions and assignments
Ethics committee charter and meeting records
Accountability mapping documentation