Responsible use

The requirement, in our words

Set out in writing how the organization makes sure AI systems are used responsibly, covering approvals, cost including monitoring and maintenance, approved sourcing and applicable legal requirements, for internally built and third-party systems.

What it means for human oversight

Responsible use is the approval gate before a system reaches an operator. The approval should require a named overseer, an information pack and a tested stop mechanism.

How to evidence it

Attach the artefacts above to the Responsible use row with the system name, the owner and the date. The first one is the anchor: A documented responsible-use process. The OH-30 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Approval records for each system. If that artefact for OH-30 cannot be produced, the row is a gap, whatever the policy says.

OH-30 carries 3 evidence items and 2 common gaps. For responsible use, observe one live decision rather than reading the procedure, because the question is whether the person can use the control without asking permission. The OH-30 statement above is ours, written from ISO/IEC 42001:2023, A.9.2, not a reproduction of the licensed text.

Common gaps

• Staff adopt AI tools without approval
• Ongoing monitoring cost ignored

Related units

• Competence of the overseer
• Intended use
• Context and the role you play