ISO 42001 Annex A 10.4 Consider customer expectations and needs when using AI
What it says
The organization shall ensure that its responsible approach to the development and use of AI systems considers their customer expectations and needs.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure your responsible approach to building and using artificial intelligence (AI) takes account of what your customers expect and need.
This control is about keeping your customers in mind whenever you build or use artificial intelligence (AI). An AI management system (AIMS) is the set of policies and practices you use to govern AI responsibly. This control says that responsible AI is not only about your own rules and risks; it must also reflect what the people who buy from or rely on you actually expect and need. For example, customers may expect to know when they are talking to an AI chatbot rather than a person, to have a human they can reach if the AI gets something wrong, or to trust that an AI tool will not treat them unfairly or misuse their personal information. If you ignore those expectations, you can lose customer trust even when the technology works as designed. So this control asks you to find out what your customers expect from your AI, take those expectations seriously, and let them shape how you develop and run your AI systems.
Free. Save your status, tasks and notes.
Why it matters
Ignoring customer expectations for AI erodes trust, drives complaints and churn, and can breach consumer or privacy obligations, harming revenue and reputation.
How to implement
The AI lead should gather customer expectations about your AI systems through surveys, support tickets, complaints and feedback forms, then write them into a short customer expectations summary that informs AI design decisions.
The product owner should set clear, customer-facing standards for each AI system, such as telling customers when they are interacting with AI, offering a way to reach a human, and explaining how their data is used.
The compliance manager should map customer needs to the relevant rules and commitments, for example privacy obligations, consumer protection law and any promises made in marketing, so AI behaviour stays consistent with what customers were told.
The customer service team should give people an easy path to question or appeal an AI-driven outcome, such as a refund decision or a recommendation, and feed the patterns from those appeals back to the AI lead.
Senior management should review customer feedback and complaints about AI at regular intervals and require changes to AI systems when customer expectations are not being met.
Keep it running
Refresh your view of customer expectations regularly, as they shift with new AI features and public concern. Feed complaints back into AI design.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
evidence that the organisation has identified its customers' expectations and needs for AI systems, such as survey results, complaint logs or feedback summaries.
Good evidence
a documented, current record that clearly informs AI decisions.
- Check 2 of 5What an auditor asks for
Ask for
how customers are told when they are interacting with AI and how they can reach a human.
Look at
the actual customer-facing messages or interfaces.
Good evidence
plain, visible disclosure and an easy escalation route.
- Check 3 of 5What an auditor asks for
Ask for
to see how customer expectations were used to shape a specific AI system.
Look at
design notes, requirements or change records that reference customer needs.
Good evidence
a traceable link from customer feedback to AI changes.
- Check 4 of 5What an auditor asks for
Ask for
the process that handles customer complaints or appeals about AI outcomes.
Look at
recent cases and how they were resolved.
Good evidence
timely responses with evidence that recurring issues led to AI improvements.
- Check 5 of 5What an auditor asks for
Ask for
how senior management reviews whether AI meets customer expectations.
Look at
meeting minutes or review records.
Good evidence
regular management review with decisions and follow-up actions recorded.
Mappings
Closest match in ISO/IEC 27001: A.5.34, Privacy and protection of personally identifiable information, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.34.
Annex A 10.4 mandates that customer expectations and needs be integral to responsible AI systems, including handling customer data transparently. Annex A 5.34 overlaps by focusing on privacy compliance-aligned with customer privacy expectations when AI uses personal data. However, Annex A 10.4 addresses broader expectations such as AI accuracy and transparency beyond privacy.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents