Control A.10.4: Customers
Make sure the organization's responsible approach to developing and using AI systems takes account of its customers' expectations and needs.
What control A.10.4 asks
Make sure the organization's responsible approach to developing and using AI systems takes account of its customers' expectations and needs.
Why it matters for privacy
Customer expectations are a privacy input. A customer who is told the system does not train on their data will treat a change as a breach of trust, whatever the contract says.
Where the draft lands: the promise to the customer. The draft's risk evaluation includes the expectations of the people and organizations the system touches.
Basis for A.10.4: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. Treating the risk: data and third parties.
Evidence for control A.10.4
The list below is what a reviewer will want produced, not described. For control A.10.4 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Customers Record of customer expectations and needs (requirements, contracts, usage agreements)
- Customers Allocation of responsibilities between provider and customer
- Customers Information given to customers to treat their risks, including domain-of-use limits
Where control A.10.4 commonly fails
- Customer expectations never captured
- Domain-of-use limits not communicated to customers
What to do about control A.10.4 before the draft lands
Record what customers are told about data use, check that the system does it, and make a change to that statement a reviewed decision.
Do not rebuild around a draft. Control A.10.4 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.10.4
- Control A.7.2, Data for development and enhancement of AI system
- Control A.7.3, Acquisition of data
- Control A.7.4, Quality of data for AI systems
- Control A.7.5, Data provenance
← Control A.10.3 | Control A.2.2 →
Open the full index. The public record behind control A.10.4 shows the scope and the lifecycle.
Control A.10.4 is cited to ISO/IEC 42001:2023, Annex A. The requirement, evidence and gaps are our wording from the control record; the privacy overlay is read from the ISO page and its abstract. The full list.