Reporting of concerns

The requirement, in our words

Define and operate a process for people to raise concerns about what the organization does in relation to an AI system at any point in its life cycle, with a route to investigation and escalation.

What it means for human oversight

The person closest to the system needs a route to report a concern without reprisal. The route should cover contractors and third-party operators, and it should record the response time.

How to evidence it

Attach the artefacts above to the Reporting of concerns row with the system name, the owner and the date. The first one is the anchor: A concern reporting procedure with confidential or anonymous options. The OH-19 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Promotion of the channel to staff and contractors. If that artefact for OH-19 cannot be produced, the row is a gap, whatever the policy says.

OH-19 carries 3 evidence items and 3 common gaps. For reporting of concerns, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-19 statement above is ours, written from ISO/IEC 42001:2023, A.3.3, not a reproduction of the licensed text.

Common gaps

• Channel exists but is unknown to contractors
• No protection from reprisal
• Reports not escalated to management

Related units

• Context and the role you play
• What the management system covers
• AI risk assessment