Control A.6.2.2: AI system requirements and specification
Write down the requirements for any new AI system and for any material enhancement of an existing one.
What control A.6.2.2 asks
Write down the requirements for any new AI system and for any material enhancement of an existing one.
Why it matters for privacy
A requirement that does not mention personal data will not be tested for it. The specification is the last cheap place to stop a privacy problem.
Where the draft lands: requirements carry the risk. The abstract applies to systems being developed. The specification is where the organization decides what the system will do with personal data.
Basis for A.6.2.2: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. The lifecycle and where privacy risk enters.
Evidence for control A.6.2.2
The list below is what a reviewer will want produced, not described. For control A.6.2.2 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Requirements Requirements specification spanning the life cycle
- Requirements Documented rationale and goals (business case, customer request, policy)
- Requirements Records of requirements revisited when the system cannot operate as intended
Where control A.6.2.2 commonly fails
- Rationale for building the system undocumented
- Requirements never revisited after feasibility changes
What to do about control A.6.2.2 before the draft lands
Add privacy requirements to each specification: the data allowed, the purpose, the retention, the output restrictions, the logging and the tests that prove them.
Do not rebuild around a draft. Control A.6.2.2 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.6.2.2
- Control A.4.2, Resource documentation
- Control A.4.3, Data resources
- Control A.4.4, Tooling resources
- Control A.4.5, System and computing resources
← Control A.6.1.3 | Control A.6.2.3 →
Open the full index. The public record behind control A.6.2.2 shows the scope and the lifecycle.
Source for control A.6.2.2: ISO/IEC 42001:2023, Annex A, retrieved 22 October 2026, at the standards library. The overlay rests on the public 27091 record. Every source.