The four Annex A controls for information flows about AI systems: documentation for users, external reporting of adverse impacts, incident communication and reporting obligations to interested parties.
Determining and providing the information users of an AI system need, such as intended purpose, limitations, human oversight and how to interpret outputs, as distinct from technical documentation under A.6.2.7.
Giving interested parties outside the organization a way to report adverse impacts of an AI system: intake channels, triage, response and records, as distinct from internal concern reporting under A.3.3.
Determining and documenting a plan for telling users about incidents involving an AI system: what counts as an incident, who is told, how fast and through which channel.
Determining and documenting the organization's obligations to report information about its AI systems to interested parties such as regulators, customers or the public, and meeting them.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.