A.3.2 AI roles and responsibilities
Defining and allocating AI roles and responsibilities to fit the organization's needs: who owns AI risk, impact assessment, development, oversight and operation, and how assignments are evidenced.
A.3 Internal organization
The two Annex A controls that establish accountability inside the organization for AI: defined AI roles and responsibilities, and a process for raising concerns about AI systems.
A.3.3 Reporting of concerns
A process for people to report concerns about the organization's role with respect to an AI system across its life cycle: channels, confidentiality, escalation and records, distinct from external adverse-impact reporting under A.8.3.
