Control A.6.2.5: AI system deployment
Document a deployment plan and make sure the appropriate requirements are met before deployment.
What control A.6.2.5 asks
Document a deployment plan and make sure the appropriate requirements are met before deployment.
Why it matters for privacy
Deployment is the moment the risk becomes real for the people in the data. A deployment plan that does not name the privacy checks is a plan to find out in production.
Where the draft lands: the deployment stage. The lifecycle in the abstract includes deployment. This is the gate where the earlier work is either used or wasted.
Basis for A.6.2.5: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. Operating, monitoring and telling people.
Evidence for control A.6.2.5
The list below is what a reviewer will want produced, not described. For control A.6.2.5 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Deployment Deployment plan addressing development and deployment environments and separately deployed components
- Deployment Release criteria met (V&V passed, metrics achieved, user testing, management sign-off)
- Deployment Consideration of interested parties' perspectives
Where control A.6.2.5 commonly fails
- Deployed without documented release criteria
- Model and software deployed separately without joint checks
What to do about control A.6.2.5 before the draft lands
Require a privacy sign-off before deployment: the assessment is current, the retention is set, the logs are configured, the notice is published and the incident route is open.
Do not rebuild around a draft. Control A.6.2.5 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.6.2.5
- Control A.3.3, Reporting of concerns
- Control A.6.2.6, AI system operation and monitoring
- Control A.6.2.8, AI system recording of event logs
- Control A.8.2, System documentation and information for users
← Control A.6.2.4 | Control A.6.2.6 →
Open the full index. The public record behind control A.6.2.5 shows the scope and the lifecycle.
Read control A.6.2.5 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.