Skip to content
A.8 Information for interested parties of AI systems
ISO 42001A.8.2

ISO 42001 Annex A 8.2 Provide users the information they need to use the AI system

What it says

The organization shall determine and provide the necessary information to users of the AI system.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Your organisation must work out and give users the information they need to understand and use the artificial intelligence (AI) system properly.

This control is about making sure the people who use your artificial intelligence (AI) system are given the information they need to use it correctly and safely. Think of it like the instructions, label and warnings that come with any product. Users should understand what the AI system is for, what it can and cannot do, how reliable its results are, and when a human should check its output. They should also know how to get help if something does not look right. If users do not have this information, they may trust the AI in situations it was never designed for, or misread its results. As part of an AI management system (AIMS, the set of policies and processes your organisation uses to govern AI responsibly), this control protects both your users and your organisation by setting clear, honest expectations about how the AI should be used.

Why it matters

Without clear user information, people may rely on the AI in ways it was not designed for, leading to mistakes, misuse and lost trust.

How to implement

  1. The product owner identifies who actually uses the AI system (for example staff, customers, or partner businesses) and writes down what each group needs to know to use it safely and correctly.

  2. A nominated subject matter expert prepares plain-language user information covering the system's intended purpose, its known limitations, how accurate its results typically are, and the situations where a human should review the output before acting on it.

  3. The team makes the information easy to find at the point of use, for example as on-screen guidance, a help page, a printed instruction sheet, or wording built into the AI's responses, rather than buried in a document no one reads.

  4. The AI lead sets a schedule to review and update the user information whenever the system changes, such as after a model update or a new feature, so the guidance always matches how the AI actually behaves.

  5. Procurement ensures that any AI system bought from a supplier comes with adequate documentation for your users, and obtains the vendor's instructions, capability statements and limitation notes as part of the contract.

Keep it running

Treat user information as living material: review it whenever the AI system changes so guidance always matches how the system actually behaves.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the user information or documentation provided with the AI system.

    Look at

    Check that it states the system's intended purpose, capabilities and limitations in language a non-technical user can understand.

    Good evidence

    The documentation plainly explains what the system is for, what it can and cannot do, and is written for its actual users rather than for technical staff.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for a demonstration of how and where users actually receive this information.

    Look at

    Check it is available at the point of use rather than only on request.

    Good evidence

    Clear on-screen guidance or an easily accessible help resource is available where users interact with the AI system.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask who the identified users of the AI system are.

    Look at

    Check whether the organisation has tailored the information to each user group's needs rather than offering one generic document.

    Good evidence

    Each identified user group receives information matched to how they use the system and what they need to know.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for evidence that the user information is kept current, such as version dates or a review log.

    Look at

    Look for updates made after system or model changes.

    Good evidence

    The review log or version history shows a review within the last 12 months and updates following relevant system or model changes.

  5. Check 5 of 5What an auditor asks for

    Ask for

    For AI systems supplied by a vendor, ask to see the supplier-provided user documentation.

    Look at

    Check whether the organisation has reviewed it for completeness rather than simply passing it on unchecked.

    Good evidence

    The organisation can show it assessed the supplier documentation against its users' needs and filled any gaps before providing it.

Mappings

Closest match in ASD Information Security Manual: ISM-2084, Document AI model and system characteristics, which partially overlaps with this control.

ASD ISM

ASD Information Security Manual: 1 mapping

  • ISM-2084Document AI model and system characteristicsPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.

Get help with this control

ISO 42001 training

Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.

PolicyMint

Turn this control into your AI policy

PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.

Draft your ISO 42001 documents