Control A.9.3: Objectives for responsible use of AI system
Identify and record the objectives that steer how AI systems are used responsibly.
What control A.9.3 asks
Identify and record the objectives that steer how AI systems are used responsibly.
Why it matters for privacy
An objective for responsible use makes the trade-off visible: speed against data minimisation, convenience against retention. Without it, the default wins.
Where the draft lands: the direction of use. The draft's treatment of risk has to reach the business user. An objective is how that happens.
Basis for A.9.3: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Operating, monitoring and telling people.
Evidence for control A.9.3
This is the evidence an auditor or a privacy reviewer asks to see. For control A.9.3 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Responsible use Responsible use objectives (for example accessibility, privacy and security, robustness, safety, reliability, explainability, transparency, accountability, fairness)
- Responsible use Mechanisms to achieve them including meaningful human oversight points
- Responsible use Training records for oversight personnel
Where control A.9.3 commonly fails
- Human oversight objectives not tied to life cycle stages
- Oversight staff not trained on system documentation
What to do about control A.9.3 before the draft lands
Set objectives for use, such as the share of systems with an approved data classification, and report them at management review.
The requirement for control A.9.3 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.9.3
- Control A.3.3, Reporting of concerns
- Control A.6.2.5, AI system deployment
- Control A.6.2.6, AI system operation and monitoring
- Control A.6.2.8, AI system recording of event logs
← Control A.9.2 | Control A.9.4 →
Open the full index. The public record behind control A.9.3 shows the scope and the lifecycle.
Control A.9.3 is cited to ISO/IEC 42001:2023, Annex A. The requirement, evidence and gaps are our wording from the control record; the privacy overlay is read from the ISO page and its abstract. The full list.