At a glance
- Ref
- OH-01
- Theme
- Accountability
- Held source
- ISO/IEC 42001:2023
- Citation
- ISO/IEC 42001:2023, 4.1
- Evidence
- 3 items
- Gaps
- 2 common
Evidence to keep
- Context and the role you playA register of internal and external issues, with a recorded decision on climate change
- Context and the role you playA documented role determination for each AI system in scope
- Context and the role you playAn intended purpose statement for each system
Questions before you sign
- Which role do we play for each system, and where is that written?
- Does the role determination name the person who carries the oversight duty?
- Has the role changed since the system was procured or modified?
The requirement, in our words
Work out the internal and external issues that affect whether the AI management system can do what it is meant to, and settle which role the organization plays for each AI system: provider, producer, customer, partner or subject. The role determines which duties follow.
What it means for human oversight
The overseer's duty changes with the role. A provider must design oversight into the system; a deployer must assign it to competent people. If the role is recorded only for the organization as a whole, the operator of a specific system has no stated duty.
How to evidence it
Attach the artefacts above to the Context and the role you play row with the system name, the owner and the date. The first one is the anchor: A register of internal and external issues, with a recorded decision on climate change. The OH-01 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.
The reviewer will sample one live decision and ask for A documented role determination for each AI system in scope. If that artefact for OH-01 cannot be produced, the row is a gap, whatever the policy says.
OH-01 carries 3 evidence items and 2 common gaps. For context and the role you play, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-01 statement above is ours, written from ISO/IEC 42001:2023, 4.1, not a reproduction of the licensed text.
Common gaps
- Role recorded for the organization as a whole but not per system
- Legal issues such as prohibited uses missing from the issues register
Related units
Source for this page: ISO/IEC 42001:2023, 4.1. Open ISO/IEC 42001:2023, 4.1 and compare it with the OH-01 statement above. Retrieved 2026-10-21.