Verification and validation

The requirement, in our words

Set out in writing how the system will be verified and validated and the criteria for each measure, including representative test data, acceptable error rates, reliability and safety requirements, responsible-AI objectives and operational ranges.

What it means for human oversight

Validation should include the human control, not only the model. Test whether the overseer can see the limit, interpret the output and exercise the override in the conditions of use.

How to evidence it

Attach the artefacts above to the Verification and validation row with the system name, the owner and the date. The first one is the anchor: A V&V plan with methods, tools, data and release criteria. The OH-24 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Evaluation results against the criteria. If that artefact for OH-24 cannot be produced, the row is a gap, whatever the policy says.

OH-24 carries 3 evidence items and 3 common gaps. For verification and validation, test the control on a live system at production volume, since a version that works only in a pilot has not yet been shown to work. The OH-24 statement above is ours, written from ISO/IEC 42001:2023, A.6.2.4, not a reproduction of the licensed text.

Common gaps

• Test data not representative
• No acceptable error rates
• Failing criteria accepted without reconsidering use

Related units

• AI risk assessment
• Operational planning and control
• Context and the role you play