At a glance
- Ref
- OH-11
- Theme
- Life cycle
- Held source
- ISO/IEC 42001:2023
- Citation
- ISO/IEC 42001:2023, 8.1
- Evidence
- 3 items
- Gaps
- 2 common
Evidence to keep
- Operational planning and controlProcess criteria and operating procedures
- Operational planning and controlControl effectiveness monitoring results
- Operational planning and controlChange records, including unintended changes
Questions before you sign
- What are the written criteria for an oversight decision?
- Who monitors whether the process is followed?
- Are outsourced operators inside the control?
The requirement, in our words
Plan the processes needed to meet requirements, run them under control, set process criteria, implement the chosen controls and monitor their effectiveness. Keep documented information sufficient to show the processes were carried out as planned.
What it means for human oversight
Oversight is an operating process with criteria: what the overseer checks, at what volume, within what time, and what they do when the output is out of range. The process needs a control owner and a monitoring method.
How to evidence it
Attach the artefacts above to the Operational planning and control row with the system name, the owner and the date. The first one is the anchor: Process criteria and operating procedures. The OH-11 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.
The reviewer will sample one live decision and ask for Control effectiveness monitoring results. If that artefact for OH-11 cannot be produced, the row is a gap, whatever the policy says.
OH-11 carries 3 evidence items and 2 common gaps. For operational planning and control, test the control on a live system at production volume, since a version that works only in a pilot has not yet been shown to work. The OH-11 statement above is ours, written from ISO/IEC 42001:2023, 8.1, not a reproduction of the licensed text.
Common gaps
- Controls implemented but effectiveness never monitored
- Outsourced AI services outside operational control
Related units
Source for this page: ISO/IEC 42001:2023, 8.1. Open ISO/IEC 42001:2023, 8.1 and compare it with the OH-11 statement above. Retrieved 2026-10-21.