At a glance
- Ref
- OH-18
- Theme
- Accountability
- Held source
- ISO/IEC 42001:2023
- Citation
- ISO/IEC 42001:2023, A.3.2
- Evidence
- 3 items
- Gaps
- 2 common
Evidence to keep
- AI roles and responsibilitiesAn AI roles and responsibilities matrix
- AI roles and responsibilitiesCoverage of human oversight and the other listed areas
- AI roles and responsibilitiesEvidence the roles were assigned against the policy, objectives and risks
Questions before you sign
- Is human oversight a named role with an authority?
- Does the matrix cover the operator as well as the committee?
- Is the role resourced with time?
The requirement, in our words
Define and allocate AI roles and responsibilities according to the organization's needs, covering human oversight, security, privacy, safety, performance, development, suppliers, legal compliance, data quality, assets, impact assessment and risk management.
What it means for human oversight
The control explicitly lists human oversight as a role to allocate. The allocation should say what the role may decide, not only what it is called.
How to evidence it
Attach the artefacts above to the AI roles and responsibilities row with the system name, the owner and the date. The first one is the anchor: An AI roles and responsibilities matrix. The OH-18 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.
The reviewer will sample one live decision and ask for Coverage of human oversight and the other listed areas. If that artefact for OH-18 cannot be produced, the row is a gap, whatever the policy says.
OH-18 carries 3 evidence items and 2 common gaps. For ai roles and responsibilities, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-18 statement above is ours, written from ISO/IEC 42001:2023, A.3.2, not a reproduction of the licensed text.
Common gaps
- No role owns human oversight
- Data quality responsibility undefined across the life cycle
Related units
Source for this page: ISO/IEC 42001:2023, A.3.2. Open ISO/IEC 42001:2023, A.3.2 and compare it with the OH-18 statement above. Retrieved 2026-10-21.