Control A.3.2: AI roles and responsibilities
Define and allocate AI roles and responsibilities according to the organization's needs.
What control A.3.2 asks
Define and allocate AI roles and responsibilities according to the organization's needs.
Why it matters for privacy
Privacy fails in the gaps between roles: the data team assumes the product team owns the retention, the product team assumes legal approved it, and nobody owns the prompt log.
Where the draft lands: the role question before the control question. The abstract applies to developers and users alike. Naming which role the organization plays is the first act of allocation, and it decides who answers for the privacy risk.
Basis for A.3.2: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Scope, role and who answers.
Evidence for control A.3.2
This is the evidence an auditor or a privacy reviewer asks to see. For control A.3.2 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Roles AI roles and responsibilities matrix
- Roles Coverage of human oversight, security, privacy, safety, performance, development, suppliers, legal compliance, data quality, assets and resources, impact assessment and risk management
- Roles Evidence roles were assigned considering policy, objectives and risks
Where control A.3.2 commonly fails
- No role owns human oversight
- Data quality responsibility undefined across the life cycle
What to do about control A.3.2 before the draft lands
Name one accountable owner for each AI system and one for the personal data in it. Put the pair in the register, with the deputy and the escalation route.
The requirement for control A.3.2 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.3.2
- Control A.2.2, AI policy
- Control A.2.3, Alignment with other organizational policies
- Control A.4.6, Human resources
- Control A.10.2, Allocating responsibilities
← Control A.2.4 | Control A.3.3 →
Open the full index. The public record behind control A.3.2 shows the scope and the lifecycle.
Read control A.3.2 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.