Allocating responsibilities with third parties

The requirement, in our words

Make sure responsibilities across the life cycle are divided among the organization, suppliers, partners, customers and other third parties, and record the allocation in the contracts.

What it means for human oversight

A supplier can build the model, but it cannot carry the deployer's oversight duty. The contract should say who supplies the information, who keeps the log, who monitors and who can stop the system.

How to evidence it

Attach the artefacts above to the Allocating responsibilities with third parties row with the system name, the owner and the date. The first one is the anchor: A register of parties with roles and responsibilities. The OH-32 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Contract clauses allocating the duties. If that artefact for OH-32 cannot be produced, the row is a gap, whatever the policy says.

OH-32 carries 3 evidence items and 2 common gaps. For allocating responsibilities with third parties, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-32 statement above is ours, written from ISO/IEC 42001:2023, A.10.2, not a reproduction of the licensed text.

Common gaps

• Data and model providers missing from the allocation
• Personal data roles not determined

Related units

• Context and the role you play
• What the management system covers
• AI risk assessment