Control A.8.5: Information for interested parties
Identify and record what the organization is obliged to tell interested parties about the AI system.
What control A.8.5 asks
Identify and record what the organization is obliged to tell interested parties about the AI system.
Why it matters for privacy
Different audiences need different information: a user needs limits, a regulator needs evidence, an affected person needs an explanation. One page cannot serve all three.
Where the draft lands: the record of what was said. The draft applies across sectors and organization types. Information obligations follow the audience, not the product.
Basis for A.8.5: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. Evidence, review and the date.
Evidence for control A.8.5
The list below is what a reviewer will want produced, not described. For control A.8.5 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Reporting obligations Register of obligations to report AI system information to regulators, customers and others, with timeframes
- Reporting obligations Records of information shared (technical documentation, risks, impact assessment results, logs)
Where control A.8.5 commonly fails
- Regulatory reporting duties for AI systems not identified
- Law enforcement information requests not addressed
What to do about control A.8.5 before the draft lands
Define the audiences, what each is told, in what form and how often. Keep the versions dated and consistent with the technical documentation.
Do not rebuild around a draft. Control A.8.5 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.8.5
- Control A.2.4, Review of the AI policy
- Control A.6.2.3, Documentation of AI system design and development
- Control A.6.2.7, AI system technical documentation
← Control A.8.4 | Control A.9.2 →
Open the full index. The public record behind control A.8.5 shows the scope and the lifecycle.
Read control A.8.5 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.