ISO 42001 Annex A 4.6 Document the people and skills running your AI system
What it says
As part of resource identification, the organization shall document information about the human resources and their competences utilized for the development, deployment, operation, change management, maintenance, transfer and decommissioning, as well as verification and integration of the AI system.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe organisation must record who works on its AI system across its whole life and the competences they bring.
This control is about knowing, and writing down, which people and what skills are needed to run your artificial intelligence (AI) system safely from start to finish. As part of working out what resources your AI management system (AIMS) needs, you record the human resources involved at every stage: building (developing) the AI, putting it into use (deployment), running it day to day (operation), making changes to it, maintaining it, handing it to someone else (transfer) or shutting it down (decommissioning), as well as checking it works correctly (verification) and connecting it to other systems (integration). For each of these stages you note the people or roles involved and the competences, meaning the knowledge, qualifications and experience, they have. The aim is simple: make sure the right people with the right skills are in place for every part of the AI system's life, so nothing critical depends on luck or one person's memory. This documentation also helps you spot skills gaps, plan training and avoid relying on a single individual who could leave.
Free. Save your status, tasks and notes.
Why it matters
Without documenting who runs your AI and their skills, critical stages may be handled by unqualified people, creating safety, compliance and key-person risks.
How to implement
The AI lead should map every stage of the AI system's life, from development and deployment through operation, change management, maintenance, transfer, decommissioning, verification and integration, and list the roles needed for each stage in a single document.
The human resources manager should record each person or role against those stages along with their relevant competences, capturing qualifications, training completed, certifications and hands-on experience for every role.
Managers should review the documented roles and competences whenever a person joins, changes position or leaves, updating the record so it always reflects who is actually responsible for each part of the AI system.
The AI lead should compare the competences on record against what each stage actually demands, flag any gaps, and arrange training or hiring to close them before they cause problems.
The organisation should store this human resources record in a controlled location with version history, so the board and auditors can see who is competent to handle each phase of the AI system at any time.
Keep it running
Review the human resources and competences record whenever staff join, change roles or leave, and at least once a year, so it stays accurate.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
the document that lists the human resources and competences used across the AI system's lifecycle, and confirm it covers development, deployment, operation, change management, maintenance, transfer, decommissioning, verification and integration.
Look at
how competences are recorded for each role and check they include concrete evidence such as qualifications, certifications, training records and experience rather than vague claims.
- Check 2 of 2What an auditor asks for
Ask for
how the record is kept current and review version history or update dates to confirm it is revised when people join, move or leave the organisation.
Look at
whether the organisation has identified any competence gaps and check there is a plan, such as training or recruitment, to address them.
Good evidence
a complete, dated and version-controlled record mapping named people or roles and their proven competences to every lifecycle stage of the AI system, kept up to date and clearly owned.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining information security roles and responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.2.
Annex A 4.6 involves documenting personnel and their skills across the AI lifecycle. Annex A 5.2 involves defining and allocating information security roles and responsibilities, aligning where those roles intersect with AI security aspects. Annex A 4.6 extends beyond security roles to document all lifecycle functions including non-security areas such as integration and decommissioning.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-2035.
Annex A 4.6 requires the organisation to document human resources and competences across the AI system lifecycle, from development to decommissioning. ISM-2035 requires identifying and documenting security roles and responsibilities to support the software development life cycle, which overlaps with certain AI system activities. Annex A 4.6 covers a broader lifecycle including non-security roles, while ISM-2035 focuses strictly on SDLC security roles.
- ISM-2038Maintain a software developer cyber security knowledge and skills registerPartially overlaps
This control partially overlaps ISM-2038.
Annex A 4.6 requires documentation of people and competences throughout the AI system lifecycle. ISM-2038 focuses on maintaining a register of software developers' cyber security skills, overlapping wherever software development in AI systems requires security-relevant competences. Annex A 4.6 covers a range of competencies, not limited to developers or cyber security.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents