The nine Annex A controls for responsible AI system development and the life cycle: objectives and processes for responsible design, then requirements, design records, verification and validation, deployment, operation, technical documentation and event logs.
Identifying and documenting the objectives that guide responsible AI development, such as fairness, security or transparency, and building measures to meet them into the development life cycle.
Defining and documenting the specific processes for responsible AI design and development, including human oversight, testing gates and approval to proceed, which the A.6.2 life cycle controls then apply stage by stage.
Specifying and documenting requirements for new AI systems or material enhancements to existing ones: business purpose, performance, trustworthiness and socio-technical requirements, and how they are approved.
Documenting AI system design and development against the organization's objectives, documented requirements and specification criteria: architecture, model choices, training approach and design decisions.
Defining and documenting verification and validation measures for AI systems and the criteria for using them: test sets, metrics, evaluation, red teaming and release acceptance criteria.
Documenting a deployment plan for each AI system and confirming its requirements are met before release: release approval, environment checks and rollback, as distinct from ongoing operation under A.6.2.6.
Defining and documenting what an AI system needs to run responsibly in production: system and performance monitoring, repairs, updates and support, drift detection and decommissioning.
Deciding what technical documentation each category of interested party needs, such as users, partners and supervisory authorities, and providing it in a suitable form, including limits and residual risks.
Deciding at which life cycle phases AI system event logs are recorded, at minimum while the system is in use: what to log, retention, integrity and how logs support monitoring and incident investigation.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.