Control A.10.2: Allocating responsibilities
Make sure responsibilities across the AI system life cycle are divided among the organization, its suppliers, partners, customers and other third parties.
What control A.10.2 asks
Make sure responsibilities across the AI system life cycle are divided among the organization, its suppliers, partners, customers and other third parties.
Why it matters for privacy
Allocation is where privacy responsibility is either agreed or assumed. A supplier that hosts the model and a customer that supplies the data both have a role; neither is obvious.
Where the draft lands: who is responsible for the personal data. The abstract applies to developers and users. The same system can have several parties, and the privacy duty follows the role each one plays.
Basis for A.10.2: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. Scope, role and who answers.
Evidence for control A.10.2
These are the records that turn the control from a statement into something checkable. For control A.10.2 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Third parties Register of all parties in the AI system life cycle with their roles and responsibilities
- Third parties Contract clauses allocating responsibilities
- Third parties PII controller and processor determination where PII is processed
Where control A.10.2 commonly fails
- Data providers and model providers missing from the allocation
- PII roles not determined
What to do about control A.10.2 before the draft lands
Write the responsibility matrix for each system and each party, including who answers a subject request, who notifies a breach and who decides retention. Put it in the contract.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.10.2 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.10.2
- Control A.2.2, AI policy
- Control A.2.3, Alignment with other organizational policies
- Control A.3.2, AI roles and responsibilities
- Control A.4.6, Human resources
← Control A.9.4 | Control A.10.3 →
Open the full index. The public record behind control A.10.2 shows the scope and the lifecycle.
Read control A.10.2 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.