Control A.6.2.6: AI system operation and monitoring
Define and document what the AI system needs for ongoing operation, which at a minimum means monitoring of the system and its performance, repair, updating and support.
What control A.6.2.6 asks
Define and document what the AI system needs for ongoing operation, which at a minimum means monitoring of the system and its performance, repair, updating and support.
Why it matters for privacy
Operation is where the model meets real data. Monitoring has to include privacy signals, not only accuracy and uptime.
Where the draft lands: the operation stage. The abstract asks for risks to be identified across the lifecycle, which includes the years after launch.
Basis for A.6.2.6: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. Operating, monitoring and telling people.
Evidence for control A.6.2.6
These are the records that turn the control from a statement into something checkable. For control A.6.2.6 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Operation Operating procedures covering monitoring, repair, update and support
- Operation Performance monitoring on production data including drift and continuous learning checks
- Operation Update process with user communication
- Operation Identification of AI-specific security threats in operation
Where control A.6.2.6 commonly fails
- Drift not monitored
- Updates pushed without informing users
- Use beyond the designed purpose not reviewed
What to do about control A.6.2.6 before the draft lands
Monitor for unexpected personal data in inputs and outputs, for retention drift, for a supplier model change and for access anomalies. Set a threshold that triggers a review.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.6.2.6 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.6.2.6
- Control A.3.3, Reporting of concerns
- Control A.6.2.5, AI system deployment
- Control A.6.2.8, AI system recording of event logs
- Control A.8.2, System documentation and information for users
← Control A.6.2.5 | Control A.6.2.7 →
Open the full index. The public record behind control A.6.2.6 shows the scope and the lifecycle.
Source for control A.6.2.6: ISO/IEC 42001:2023, Annex A, retrieved 22 October 2026, at the standards library. The overlay rests on the public 27091 record. Every source.