Documented information

The requirement, in our words

Define what documented information the management system includes, how it is created and updated, and how it is controlled: available where needed, protected, versioned and retained.

What it means for human oversight

Oversight evidence is only useful if the auditor can find the version that was in force on the date of the decision. Document control is what makes the evidence index trustworthy.

How to evidence it

Attach the artefacts above to the Documented information row with the system name, the owner and the date. The first one is the anchor: A document control procedure. The OH-10 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for A controlled index of AI system records. If that artefact for OH-10 cannot be produced, the row is a gap, whatever the policy says.

OH-10 carries 3 evidence items and 2 common gaps. For documented information, keep the version the operator actually received with its date, because the current intranet copy is not evidence of what was in force. The OH-10 statement above is ours, written from ISO/IEC 42001:2023, 7.5, not a reproduction of the licensed text.

Common gaps

• Document control not applied to AI system records
• Old versions still in use in the operating area

Related units

• Information for users
• Communicating incidents
• Context and the role you play