ISO 42001 Annex A 8.2Provide Users the Information They Need to Use the AI System
Your organisation must work out and give users the information they need to understand and use the artificial intelligence (AI) system properly.
Plain language
This control is about making sure the people who use your artificial intelligence (AI) system are given the information they need to use it correctly and safely. Think of it like the instructions, label and warnings that come with any product. Users should understand what the AI system is for, what it can and cannot do, how reliable its results are, and when a human should check its output. They should also know how to get help if something does not look right. If users do not have this information, they may trust the AI in situations it was never designed for, or misread its results. As part of an AI management system (AIMS, the set of policies and processes your organisation uses to govern AI responsibly), this control protects both your users and your organisation by setting clear, honest expectations about how the AI should be used.
Framework
ISO/IEC 42001:2023
Control effect
Preventative
Classifications
N/A
Official last update
01 Dec 2023
Control Stack last updated
15 Sept 2026
Official control statement
The organisation shall determine and provide the necessary information to users of the AI system.
Why it matters
Without clear user information, people may rely on the AI in ways it was not designed for, leading to mistakes, misuse and lost trust.
Operational notes
Treat user information as living material: review it whenever the AI system changes so guidance always matches how the system actually behaves.
Implementation tips
- The product owner identifies who actually uses the AI system (for example staff, customers, or partner businesses) and writes down what each group needs to know to use it safely and correctly.
- A nominated subject matter expert prepares plain-language user information covering the system's intended purpose, its known limitations, how accurate its results typically are, and the situations where a human should review the output before acting on it.
- The team makes the information easy to find at the point of use, for example as on-screen guidance, a help page, a printed instruction sheet, or wording built into the AI's responses, rather than buried in a document no one reads.
- The AI lead sets a schedule to review and update the user information whenever the system changes, such as after a model update or a new feature, so the guidance always matches how the AI actually behaves.
- Procurement ensures that any AI system bought from a supplier comes with adequate documentation for your users, and obtains the vendor's instructions, capability statements and limitation notes as part of the contract.
Audit / evidence tips
- AskAsk for the user information or documentation provided with the AI system.Look atCheck that it states the system's intended purpose, capabilities and limitations in language a non-technical user can understand.GoodThe documentation plainly explains what the system is for, what it can and cannot do, and is written for its actual users rather than for technical staff.
- AskAsk for a demonstration of how and where users actually receive this information.Look atCheck it is available at the point of use rather than only on request.GoodClear on-screen guidance or an easily accessible help resource is available where users interact with the AI system.
- AskAsk who the identified users of the AI system are.Look atCheck whether the organisation has tailored the information to each user group's needs rather than offering one generic document.GoodEach identified user group receives information matched to how they use the system and what they need to know.
- AskAsk for evidence that the user information is kept current, such as version dates or a review log.Look atLook for updates made after system or model changes.GoodThe review log or version history shows a review within the last 12 months and updates following relevant system or model changes.
- AskFor AI systems supplied by a vendor, ask to see the supplier-provided user documentation.Look atCheck whether the organisation has reviewed it for completeness rather than simply passing it on unchecked.GoodThe organisation can show it assessed the supplier documentation against its users' needs and filled any gaps before providing it.
Cross-framework mappings
How Annex A 8.2 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 6.3 | Annex A 8.2 (ISO/IEC 42001:2023) requires the organisation to determine and provide users with the necessary information to understand an... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(2)expand_less | ||
| ISM-0252 | Annex A 8.2 (ISO/IEC 42001:2023) requires organisations to provide the necessary information for users to correctly use the AI system | |
| ISM-0435 | Annex A 8.2 (ISO/IEC 42001:2023) entails providing users with crucial information for proper AI system use | |
handshakeSupports(1)expand_less | ||
| ISM-0720 | Annex A 8.2 (ISO/IEC 42001:2023) requires determining and providing users the information they need to use the AI system appropriately | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 42001 controls in A.8 Information for interested parties of AI systems
See all A.8 Information for interested parties of AI systems controls, or browse the full ISO 42001 Annex A library.
Want to implement this AI control?
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.