Can you name the person who can stop the system, and the person who answers for it?
The people, roles and authorities that make oversight real. This theme covers the policy, the role definitions, the competence, the escalation route and the third parties.
What good looks like
A role matrix, a policy, a competence record, an escalation route and a contract allocation.
What goes wrong
An oversight committee with no operator, a role with no authority, and a supplier contract that leaves the duty unowned.
The 14 units in this theme
| Ref | Oversight unit | Theme | Held citation | Evidence |
|---|---|---|---|---|
| OH-01 | Context and the role you play | Accountability | ISO/IEC 42001:2023, 4.1 | 3 |
| OH-02 | What the management system covers | Accountability | ISO/IEC 42001:2023, 4.3 | 3 |
| OH-03 | The AI policy | Accountability | ISO/IEC 42001:2023, 5.2 | 3 |
| OH-04 | Roles, responsibilities and authorities | Accountability | ISO/IEC 42001:2023, 5.3 | 3 |
| OH-07 | AI objectives and plans | Accountability | ISO/IEC 42001:2023, 6.2 | 3 |
| OH-09 | Awareness of the policy | Accountability | ISO/IEC 42001:2023, 7.3 | 3 |
| OH-15 | Management review | Accountability | ISO/IEC 42001:2023, 9.3 | 3 |
| OH-18 | AI roles and responsibilities | Accountability | ISO/IEC 42001:2023, A.3.2 | 3 |
| OH-19 | Reporting of concerns | Accountability | ISO/IEC 42001:2023, A.3.3 | 3 |
| OH-20 | Human resources for AI | Accountability | ISO/IEC 42001:2023, A.4.6 | 3 |
| OH-32 | Allocating responsibilities with third parties | Accountability | ISO/IEC 42001:2023, A.10.2 | 3 |
| OH-33 | Assessment responsibilities | Accountability | ISO/IEC 42005:2025, 5.6 | 3 |
| OH-40 | Deployer obligations | Accountability | EU AI Act, Article 26 | 4 |
| OH-44 | Roles in the human-AI configuration | Accountability | NIST AI RMF 1.0, GV-3.2 | 3 |
Work the theme, not the document
Open one unit, answer its three questions, and attach the evidence it names. Then move to the next. The theme is complete when every row has a named owner, a dated artefact and a recorded answer to the questions. That is a higher bar than a policy, and a lower bar than a certification.
The paid kit carries the same rows with the owner, due date and status columns already in place, and a dated plan that sequences the six themes across the 120 days to the planning date.
The human oversight kit, USD 799 one off.
The 47-unit register, the 142-item evidence index, the 120-day plan and the gap questions, as PDF, CSV and XLSX. Five labelled rows are free on the specimen page.