At a glance
- Ref
- OH-31
- Theme
- Use
- Held source
- ISO/IEC 42001:2023
- Citation
- ISO/IEC 42001:2023, A.9.4
- Evidence
- 3 items
- Gaps
- 2 common
Evidence to keep
- Intended useDeployment evidence following the instructions
- Intended useChecks that input data match the documented conditions
- Intended useEvent logs showing use as intended
Questions before you sign
- What is the documented intended use?
- Is live use inside it?
- Who checks the input conditions?
The requirement, in our words
Make sure the system is used in line with its intended uses and its documentation, including the input conditions and the operating context the provider specifies.
What it means for human oversight
The overseer is the control that detects use outside the intended conditions. They need the intended use in front of them, not in a contract file.
How to evidence it
Attach the artefacts above to the Intended use row with the system name, the owner and the date. The first one is the anchor: Deployment evidence following the instructions. The OH-31 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.
The reviewer will sample one live decision and ask for Checks that input data match the documented conditions. If that artefact for OH-31 cannot be produced, the row is a gap, whatever the policy says.
OH-31 carries 3 evidence items and 2 common gaps. For intended use, observe one live decision rather than reading the procedure, because the question is whether the person can use the control without asking permission. The OH-31 statement above is ours, written from ISO/IEC 42001:2023, A.9.4, not a reproduction of the licensed text.
Common gaps
- System used on data outside its documented domain
- No logs to show use as intended
Related units
Source for this page: ISO/IEC 42001:2023, A.9.4. Open ISO/IEC 42001:2023, A.9.4 and compare it with the OH-31 statement above. Retrieved 2026-10-21.