ISO 42001 Annex A 6.2.5 AI system deployment
What it says
The organization shall document a deployment plan and ensure that appropriate requirements are met prior to deployment.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishBefore an AI system goes live, write down how it will be deployed and confirm that the conditions for a safe go-live have actually been met.
Deployment means moving an AI system out of testing and into real use where it affects real people. This control says you need two things first: a written plan for how the go-live will happen (steps, who does what, how to roll back if it goes wrong) and a check that the prerequisites set earlier in the project, such as accuracy targets, sign-offs and access controls, are genuinely in place. Going live without these is how an AI system ends up making live decisions it was never cleared to make.
Free. Save your status, tasks and notes.
Why it matters
If an AI system goes live without a documented plan and a check that its prerequisites are met, it can start making real decisions it was never validated for, for example a credit or eligibility model running in production on the wrong configuration and wrongly declining a cohort of applicants. The organisation may then have no rollback path and no record of who authorised the go-live, leaving it exposed to an OAIC complaint and forced to withdraw the system mid-operation. Affected people experience the harm before anyone notices the deployment skipped its checks.
How to implement
Have the person leading the AI project write a short deployment plan before go-live that lists the steps in order, names who carries out each one, and spells out how to back the system out if it misbehaves.
Keep it specific to this system rather than reusing a generic template.
Turn the requirements set earlier in the project into an explicit pre-deployment checklist, for example accuracy and bias thresholds met, access controls configured, and monitoring switched on, and have someone tick each item off against evidence rather than from memory before anyone presses go.
Make the go-live a recorded decision: ask a named accountable owner to date and sign off the deployment only once the checklist is complete, so there is always a record of who authorised the system to run on real users.
Release into production in a controlled way where you can, such as a pilot, a limited user group or a staged rollout, and watch that the system behaves as it did in testing before opening it up fully.
Before flipping the switch, confirm the production environment actually matches what was tested by checking the model version, configuration settings and the data sources it connects to, so the live system is the one that was approved and not a drifted copy.
Keep it running
Treat the deployment plan as a living document tied to each release, not a one-off written at the start of the project; refresh it whenever the system, its configuration, the data it uses or its operating environment changes materially. Keep the pre-deployment requirements as an explicit checklist so the go-live decision is a recorded yes/no against named conditions rather than a verbal nod. Hold the dated sign-off and the completed checklist together so that for any version running in production you can show what was confirmed and by whom before it went live.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the documented deployment plan for a named AI system that has gone live.
Look at
Whether it sets out the go-live steps, who is responsible for each, and a rollback or back-out path if the deployment fails.
Good evidence
The deployment plan lists ordered go-live steps with named owners and a clear rollback procedure for the system that was deployed.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the completed pre-deployment requirements checklist for that system.
Look at
Whether each prerequisite, such as accuracy or bias thresholds, access controls and monitoring readiness, is individually marked as met before the go-live date.
Good evidence
Every listed prerequisite is recorded as met, with evidence, and dated before the system went into production.
- Check 3 of 5What an auditor asks for
Ask for
Request the deployment authorisation or sign-off record for the go-live.
Look at
Whether a named person dated their approval to move the system into production.
Good evidence
A named authoriser signed and dated the approval to deploy, on or before the go-live date.
- Check 4 of 5What an auditor asks for
Ask for
Speak with the person who ran the deployment about how they confirmed the system was ready.
Look at
Whether they point to the plan and checklist rather than describing an ad hoc or remembered process.
Good evidence
The deployer describes following the written plan and confirming each checklist item before releasing the system.
- Check 5 of 5What an auditor asks for
Ask for
Compare the production configuration against what was tested and approved.
Look at
Whether the model version, settings and data sources in production match the approved baseline.
Good evidence
The production configuration matches the tested and approved baseline, with any differences documented and authorised.
Mappings
Closest match in ASD Information Security Manual: ISM-0912, Establish and manage system configuration changes, which partially overlaps with this control.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-0912.
Annex A 6.2.5 requires the organisation to document how an AI system will be deployed and to verify required conditions are satisfied prior to deployment. ISM-0912 supports this by mandating a change and configuration management plan with baseline configurations, change approval, documentation and notifications, which are common prerequisites that must be evidenced before production deployment. ISM-0912 is broader across all systems and changes, while Annex A 6.2.5 is specifically focused on the AI system deployment moment and readiness assurance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents