AI System Life Cycle - ISO 42001 Annex A Controls
ISO 42001 Annex A.6
Annex A.6 is where the AI system itself comes under management system control. It is the heart of the standard for AI developers and a substantial guide for deployers too.
ISO 42001 Annex A.6 - AI System Life Cycle Explained
Annex A.6 is split into two sub-sections - A.6.1 covers the management guidance for AI system development, and A.6.2 covers the AI system life cycle stages themselves. There are 10 controls in total.
A.6.1 Management guidance for AI system development
A.6.1.2 Objectives for responsible development of AI system requires the organisation to identify and document objectives to guide the responsible development of AI systems and integrate measures to achieve them across the life cycle. Objectives commonly include fairness, safety, transparency, robustness, accountability, security and privacy.
A.6.1.3 Processes for responsible AI system design and development requires the organisation to define and document the specific processes for responsible design and development. The implementation guidance lists the typical considerations - life cycle stages, testing requirements, human oversight, training data expectations, expertise required, release criteria, approvals and sign-offs, change control, usability and engagement of interested parties.
A.6.2 AI system life cycle stages
A.6.2.2 AI system requirements and specification requires the organisation to specify and document requirements for new AI systems or material enhancements to existing systems, including the rationale for development and the goals.
A.6.2.3 Documentation of AI system design and development requires the organisation to document the AI system design and development based on organisational objectives and documented requirements. The design documentation typically covers machine learning approach, learning algorithm, training data and quality, evaluation and refinement, hardware and software components, security threats considered, interface and presentation of outputs, human interaction and interoperability.
A.6.2.4 AI system verification and validation requires the organisation to define and document verification and validation measures and to specify criteria for their use. Verification confirms the AI system meets its specified requirements. Validation confirms it meets the user's needs in the operational environment.
A.6.2.5 AI system deployment requires the organisation to document a deployment plan and make sure the appropriate requirements are met before deployment. Release criteria, performance metrics, user testing and management approvals are typically built into the deployment process.
A.6.2.6 AI system operation and monitoring requires the organisation to define and document the necessary elements for ongoing operation. The minimum coverage is system and performance monitoring, repairs, updates and support. AI-specific concerns include continuous learning, concept drift, data drift, and AI-specific information security threats such as data poisoning, model stealing and model inversion attacks.
A.6.2.7 AI system technical documentation requires the organisation to determine the AI system technical documentation needed for each relevant category of interested parties and to provide it in the appropriate form. The documentation typically includes a general description of the AI system, usage instructions, technical assumptions, technical limitations and monitoring capabilities.
A.6.2.8 AI system recording of event logs requires the organisation to determine the phases of the AI system life cycle when event logs are kept, with logging required at minimum during AI system use. Event logs typically include the time and date of use, the production data the AI system operates on, and outputs that fall outside the intended operating range.
Application to deployers and developers
Annex A.6 reads naturally as a developer-side control set, but most controls apply to deployers too. Deployers do not develop the AI system but they do specify requirements, integrate AI into their environment, deploy and monitor it, generate technical documentation appropriate for their staff and users, and maintain event logs of the AI system in use. The level of detail differs but the controls apply.
For an AI deployer using a third-party AI system, the developer's documentation supports the deployer's compliance with A.6.2.3, A.6.2.4 and A.6.2.7. The deployer documents what the supplier has provided, supplements it with deployment-specific information, and retains both as the AI system technical documentation.
For organisations new to ISO 42001, Annex A.6 is often the section that takes most work. The level of structure expected for AI system development and operation is higher than many organisations have in place. Existing software development practices help, but the AI-specific concerns around training data quality, model evaluation, drift monitoring and adversarial threats need additional treatment.
Deployers using third-party AI tools should focus on A.6.2.5, A.6.2.6, A.6.2.7 and A.6.2.8 in particular. The deployment, operation and monitoring of the AI system in the deployer's environment, and the documentation of how it is used, are squarely the deployer's responsibility regardless of who built the AI.
When auditing Annex A.6, I trace through from the AI Process Register to the life cycle documentation for each AI system. For developers, I look at the design documentation, the verification and validation evidence, and the deployment records. For deployers, I look at the deployment plan, the operational monitoring, the technical documentation provided to users, and the event log retention.
The most common gap for deployers is event logs. A.6.2.8 requires logs to be kept at minimum during AI system use. Many deployers rely on the supplier's logs without confirming what is logged, who can access it, and how long it is retained. The standard expects the deployer to make this a deliberate choice rather than an assumption.
For the inspection AI, we have event logs from the supplier covering each inspection cycle and the outputs flagged. We supplement those with our own production records of what the system was inspecting and the disposition of flagged units. Combined, that gives us the operational history we need for monitoring, audit and investigation if something goes wrong.
Practical Compliance Guidance
The IMS1 Manual Section 4 Operational Processes/IMS1-4-3 Control of Operations provides the framework for the operational AI controls, with the AI-specific life cycle activities supported by dedicated registers and procedures. The F-Q111 AI System Lifecycle template is the operational document for tracking AI systems through the life cycle stages.
The following alphaZ documents support compliance with ISO 42001 Annex A.6.
| alphaZ document | How to use it |
|---|---|
| ISO 42001 AI Management System Toolkit | The full toolkit containing the AI management system documentation including the AI system life cycle template and supporting registers. |
| F-Q111 AI System Lifecycle | Records each AI system across the life cycle stages from requirements through to operation and decommissioning, supporting the controls in A.6.2. |
| F-IMS40 AI Process Register | Records the AI systems within scope and links each to the relevant life cycle documentation. |
| PP-8-100 AI Content Procedure | Sets out the procedure for the use of AI in content generation, supporting the operational controls under A.6.2.6 for organisations using generative AI tools. |
| F-IMS70 Annex A Controls | Records the Statement of Applicability including the A.6 controls with the implementation status and supporting evidence. |
Note - all the above files can be downloaded with an alphaZ subscription.
