Control A.9.4: Intended use of the AI system
Make sure the AI system is used in line with its intended uses and its accompanying documentation.
What control A.9.4 asks
Make sure the AI system is used in line with its intended uses and its accompanying documentation.
Why it matters for privacy
Intended use is the boundary that makes every other control meaningful. A system used outside it is unassessed, whatever its documentation says.
Where the draft lands: the boundary of the assessment. The draft applies to systems as they are used. A use outside the assessed purpose is a new privacy risk.
Basis for A.9.4: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. Operating, monitoring and telling people.
Evidence for control A.9.4
The list below is what a reviewer will want produced, not described. For control A.9.4 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Intended use Deployment evidence following system instructions and documentation
- Intended use Checks that input data match documented conditions
- Intended use Event logs demonstrating use as intended
- Intended use Records of concerns raised internally and to suppliers
Where control A.9.4 commonly fails
- System used on data outside its documented domain
- No logs to show use as intended
What to do about control A.9.4 before the draft lands
Publish the intended use, monitor for use outside it and treat a new use as a change that triggers the impact assessment.
Do not rebuild around a draft. Control A.9.4 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.9.4
- Control A.3.3, Reporting of concerns
- Control A.6.2.5, AI system deployment
- Control A.6.2.6, AI system operation and monitoring
- Control A.6.2.8, AI system recording of event logs
← Control A.9.3 | Control A.10.2 →
Open the full index. The public record behind control A.9.4 shows the scope and the lifecycle.
The record behind control A.9.4 is the ISO/IEC 42001:2023 Annex A set, retrieved 22 October 2026. The public 27091 abstract supplies the privacy direction, not a draft requirement. Check the sources.