At a glance
- Ref
- OH-27
- Theme
- Information
- Held source
- ISO/IEC 42001:2023
- Citation
- ISO/IEC 42001:2023, A.8.2
- Evidence
- 3 items
- Gaps
- 3 common
Evidence to keep
- Information for usersUser information covering the required elements
- Information for usersCriteria for deciding what information is given
- Information for usersValidation that users can access complete, current information
Questions before you sign
- Does the operator know the system's limits?
- Does the pack say how to override?
- Is it current?
The requirement, in our words
Determine what information users need and provide it: purpose, that the user is dealing with AI, how to interact and override, technical requirements and limits, oversight needs, accuracy, impact findings, updates, contacts and training material.
What it means for human oversight
This is the operator's instruction pack. If it omits the limits or the override, the operator cannot exercise oversight even with the best intentions.
How to evidence it
Attach the artefacts above to the Information for users row with the system name, the owner and the date. The first one is the anchor: User information covering the required elements. The OH-27 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.
The reviewer will sample one live decision and ask for Criteria for deciding what information is given. If that artefact for OH-27 cannot be produced, the row is a gap, whatever the policy says.
OH-27 carries 3 evidence items and 3 common gaps. For information for users, keep the version the operator actually received with its date, because the current intranet copy is not evidence of what was in force. The OH-27 statement above is ours, written from ISO/IEC 42001:2023, A.8.2, not a reproduction of the licensed text.
Common gaps
- Users not told they are dealing with AI
- No criteria for what users receive
- Information not updated after a change
Related units
Source for this page: ISO/IEC 42001:2023, A.8.2. Open ISO/IEC 42001:2023, A.8.2 and compare it with the OH-27 statement above. Retrieved 2026-10-21.