Control A.6.1.3: Processes for responsible design and development of AI systems
Set down in writing the particular processes the organization follows to design and build the AI system responsibly.
What control A.6.1.3 asks
Set down in writing the particular processes the organization follows to design and build the AI system responsibly.
Why it matters for privacy
Responsible design is a set of steps, not a review at the end. Privacy has to be a step in the design, with an output that the next stage consumes.
Where the draft lands: the design stage of the lifecycle. The lifecycle in the abstract starts before deployment. The design process is where a privacy risk can still be designed out.
Basis for A.6.1.3: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. The lifecycle and where privacy risk enters.
Evidence for control A.6.1.3
This is the evidence an auditor or a privacy reviewer asks to see. For control A.6.1.3 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Responsible development Documented development process covering life cycle stages, testing, human oversight requirements, impact assessment points, training data rules, developer expertise, release criteria, approvals, change control, usability and controllability and stakeholder engagement
Where control A.6.1.3 commonly fails
- No release criteria or sign-off gates
- Human oversight requirements not defined at design
What to do about control A.6.1.3 before the draft lands
Add privacy steps to the design process: data minimisation review, purpose test, retention decision, logging decision and an approval gate before development starts.
The requirement for control A.6.1.3 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.6.1.3
- Control A.4.2, Resource documentation
- Control A.4.3, Data resources
- Control A.4.4, Tooling resources
- Control A.4.5, System and computing resources
← Control A.6.1.2 | Control A.6.2.2 →
Open the full index. The public record behind control A.6.1.3 shows the scope and the lifecycle.
Read control A.6.1.3 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.