Control A.6.2.3: Documentation of AI system design and development
Document the AI system's design and development, grounded in the organization's objectives, the documented requirements and the specification criteria.
What control A.6.2.3 asks
Document the AI system's design and development, grounded in the organization's objectives, the documented requirements and the specification criteria.
Why it matters for privacy
Design documentation is how a later reviewer, a new team or an auditor understands why the system handles data the way it does.
Where the draft lands: the record of the design decision. The draft's evaluation and treatment need a record. Design documentation is the part that explains the choice.
Basis for A.6.2.3: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. Evidence, review and the date.
Evidence for control A.6.2.3
These are the records that turn the control from a statement into something checkable. For control A.6.2.3 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Design documentation Design records covering ML approach, algorithm and model type, training approach and data quality, evaluation and refinement, hardware and software, AI-specific security threats, output interface, human interaction and interoperability
- Design documentation Final system architecture documentation
Where control A.6.2.3 commonly fails
- AI-specific threats such as data poisoning, model inversion and model theft not considered
- No final architecture documentation
What to do about control A.6.2.3 before the draft lands
Record the design decisions that affect personal data, the alternatives rejected and the reason. Keep it with the system, not in a project folder that closes.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.6.2.3 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.6.2.3
- Control A.2.4, Review of the AI policy
- Control A.6.2.7, AI system technical documentation
- Control A.8.5, Information for interested parties
← Control A.6.2.2 | Control A.6.2.4 →
Open the full index. The public record behind control A.6.2.3 shows the scope and the lifecycle.
Control A.6.2.3 is cited to ISO/IEC 42001:2023, Annex A. The requirement, evidence and gaps are our wording from the control record; the privacy overlay is read from the ISO page and its abstract. The full list.