ISO 42001 Annex A 6.2.6 Defining and documenting ongoing AI system operation requirements
What it says
The organization shall define and document the necessary elements for the ongoing operation of the AI system. At the minimum, this should include system and performance monitoring, repairs, updates and support.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation must define and write down what is needed to keep each artificial intelligence (AI) system running well over time, covering at least monitoring, repairs, updates and support.
An artificial intelligence (AI) system is not something you build once and forget. To keep it working safely and reliably after it goes live, your organisation needs to decide in advance what is required to operate it day to day, and then write that down. This control asks you to define and document those operational requirements as part of your AI management system (AIMS, the set of policies and processes you use to govern AI). At a minimum the documentation must cover four things: how you will monitor the system and its performance, how repairs will be handled when something breaks, how updates will be applied, and what ongoing support will be available. Having this written down means the people running the AI know exactly what they are responsible for, problems get caught and fixed instead of being ignored, and the system keeps delivering the results it was meant to rather than quietly drifting or failing.
Free. Save your status, tasks and notes.
Why it matters
Without documented operating requirements, AI systems can degrade or fail unnoticed, with no clear owner for monitoring, repairs, updates or support.
How to implement
The AI system owner should produce a written operations document for each AI system that lists, as a minimum, how the system and its performance will be monitored, how repairs are handled, how updates are applied, and what support is available.
The operations lead should define specific performance measures and thresholds to watch (for example accuracy, response time or error rate) and record how often results are reviewed and who reviews them.
The IT or service manager should document a clear repair and support process that names who is responsible, how issues are reported, and the expected timeframe for resolving them.
The change manager should set out how updates to the AI system are planned, tested, authorised and recorded, so changes are controlled rather than ad hoc.
Senior management should formally approve the operations documentation and schedule a regular review (for example annually or after major changes) so it stays accurate as the system evolves.
Keep it running
Keep one operations document per AI system and update it whenever the system changes, so monitoring, repair, update and support arrangements stay accurate.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
the documented operating requirements for one or more live AI systems, and confirm a document actually exists rather than relying on informal knowledge.
Look at
whether the document covers all four minimum elements named in the control: system and performance monitoring, repairs, updates and support.
- Check 2 of 2What an auditor asks for
Ask for
who is responsible for each element and check that named roles or owners are recorded, not left vague.
Look at
evidence that the documented process is actually followed, such as monitoring reports, logs of repairs, and records of updates that match what the document describes.
Good evidence
a current, approved operations document for each AI system that clearly defines monitoring, repairs, updates and support, with matching records showing it is being used in practice.
Mappings
Closest match in ASD Information Security Manual: ISM-2114, Monitor baselines for AI application performance, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.6.
Annex A 6.2.6 requires the organisation to define and document the necessary elements for ongoing AI system operation, including system/performance monitoring, repairs, updates and support. ISO/IEC 27001 Annex A 8.6 focuses on monitoring and adjusting resource use, which is a subset of operational performance monitoring for AI systems. Annex A 6.2.6 also covers repairs, updates and support.
This control partially overlaps A.8.32.
Annex A 6.2.6 requires the organisation to define and document ongoing AI system operation requirements, including how updates and repairs will be handled. Annex A 8.32 requires changes to information systems to follow formal change management procedures, which will govern how AI system updates, patches, model revisions and configuration changes are executed. Annex A 6.2.6 is AI-operations focused (including monitoring and support), while Annex A 8.32 is broader and applies to all information systems changes, not specifically AI operational performance and support requirements.
ASD Essential Eight: 3 mappings
This control partially overlaps E8-MF-ML2.9.
Annex A 6.2.6 requires documented processes for ongoing operation of an AI system, including system/performance monitoring and support. E8-MF-ML2.9 overlaps by requiring cyber security events to be analysed in a timely manner, which is a monitoring-and-response activity within AI system operations for detecting compromise or abnormal behaviour. E8-MF-ML2.9 is security-incident focused, whereas Annex A 6.2.6 also includes non-security operational monitoring, repairs and update/support management.
This control partially overlaps E8-PO-ML3.6.
Annex A 6.2.6 requires the organisation to define and document ongoing AI system operation including repairs, updates and support. E8-PO-ML3.6 overlaps by specifying a patching timeliness requirement for non-critical driver vulnerabilities, which is one concrete form of update/repair activity that may be needed to keep AI systems and their platforms secure and stable. E8-PO-ML3.6 is narrowly scoped to drivers and security vulnerabilities, while Annex A 6.2.6 covers broader AI system updates (including model/runtime changes) and operational support arrangements.
- E8-PO-ML3.8Firmware vulnerabilities patched within one month if non-critical and no exploitsPartially overlaps
This control partially overlaps E8-PO-ML3.8.
Annex A 6.2.6 requires documented processes for operating and maintaining the AI system, including updates and repairs. E8-PO-ML3.8 overlaps by requiring timely patching of non-critical firmware vulnerabilities, which is part of maintaining the underlying infrastructure that AI systems depend on. E8-PO-ML3.8 is limited to firmware vulnerability remediation, whereas Annex A 6.2.6 extends to end-to-end AI system operation (including performance monitoring and support) beyond infrastructure patching.
ASD Information Security Manual: 3 mappings
This control is broader than ISM-2114.
Annex A 6.2.6 requires the organisation to define and document what is needed for ongoing AI system operations, including monitoring, repairs, updates and support. ISM-2114 specifically requires establishing baselines for AI application behaviour/performance and monitoring for deviations, which is a concrete operational monitoring requirement that Annex A 6.2.6 would be expected to document. ISM-2114 is narrower because it focuses on performance/behaviour baselining and deviation detection, not repairs, updates, or support arrangements.
This control partially overlaps ISM-0042.
Annex A 6.2.6 mandates defining and documenting ongoing AI system operational requirements, such as monitoring, repairs, updates and support. ISM-0042 requires processes for system administration, which include monitoring and support runbooks applicable to AI operations. ISM-0042 is broader, covering all systems, not AI-specific.
This control partially overlaps ISM-0912.
Annex A 6.2.6 requires documented ongoing operational requirements for an AI system, including repairs and updates. ISM-0912 requires a change and configuration management plan, which governs how operational repairs and updates are safely introduced into production.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents