Roles, responsibilities and authorities

The requirement, in our words

Top management must allocate responsibilities and authorities, make them known, and assign responsibility for keeping the management system conformant and for reporting its performance to top management.

What it means for human oversight

This is the clause that makes oversight a job rather than a committee. Name the person who can pause or stop the system, the person who reviews the decision and the person who reports performance upward.

How to evidence it

Attach the artefacts above to the Roles, responsibilities and authorities row with the system name, the owner and the date. The first one is the anchor: A role matrix or RACI for the AI management system. The OH-04 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for A named owner for conformity. If that artefact for OH-04 cannot be produced, the row is a gap, whatever the policy says.

OH-04 carries 3 evidence items and 2 common gaps. For roles, responsibilities and authorities, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-04 statement above is ours, written from ISO/IEC 42001:2023, 5.3, not a reproduction of the licensed text.

Common gaps

• No one assigned to report performance to top management
• Roles assigned but not communicated

Related units

• Context and the role you play
• What the management system covers
• AI risk assessment