ISO/IEC 42005:2025, 5.11

Approval of the assessment

Unit OH-36 in the Life cycle theme. The held citation is ISO/IEC 42005:2025, 5.11, and the row asks for 3 pieces of evidence.

At a glance

Ref: OH-36
Theme: Life cycle
Held source: ISO/IEC 42005:2025
Citation: ISO/IEC 42005:2025, 5.11
Evidence: 3 items
Gaps: 2 common

Evidence to keep

Approval of the assessmentApproval decisions for threshold exceedances and final results
Approval of the assessmentDecision authority by type
Approval of the assessmentExternal approvals where required

Questions before you sign

Who approved this assessment?
Was the approver independent of the author?
Did the approval cover the oversight design?

The requirement, in our words

Record every approval, authorisation and sign-off the assessment process requires, including any exceedance of a threshold and the final approval of the results, with the decision authority named by decision type.

What it means for human oversight

Approval is where oversight gets its mandate. The person who signs the assessment should also confirm that the overseer has the authority, the information and the time to act.

How to evidence it

Attach the artefacts above to the Approval of the assessment row with the system name, the owner and the date. The first one is the anchor: Approval decisions for threshold exceedances and final results. The OH-36 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Decision authority by type. If that artefact for OH-36 cannot be produced, the row is a gap, whatever the policy says.

OH-36 carries 3 evidence items and 2 common gaps. For approval of the assessment, test the control on a live system at production volume, since a version that works only in a pilot has not yet been shown to work. The OH-36 statement above is ours, written from ISO/IEC 42005:2025, 5.11, not a reproduction of the licensed text.

Common gaps

Assessments approved by their authors
Threshold exceedances with no recorded authorisation

Where the FDIS fits. The public abstract says the draft applies to all types of organizations across the AI system life cycle, so approval of the assessment is one of the places the guidance is expected to operate. For OH-36, the FDIS clause numbering and wording are not public, so this page cites ISO/IEC 42005:2025, 5.11 above and does not quote the draft.

Related units

Source for this page: ISO/IEC 42005:2025, 5.11. Open ISO/IEC 42005:2025, 5.11 and compare it with the OH-36 statement above. Retrieved 2026-10-21.