Skip to content
A.8 Information for interested parties of AI systems
ISO 42001A.8.3

ISO 42001 Annex A 8.3 External reporting

What it says

The organization shall provide capabilities for interested parties to report adverse impacts of the AI system.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Give people outside your organisation, not just your own customers, a clear and public way to report harm or other adverse effects caused by your AI (artificial intelligence) system.

This control is about letting outsiders raise the alarm when your artificial intelligence (AI) system causes harm. "Interested parties" here means a broad group beyond your paying customers: a member of the public turned down by an automated decision, someone wrongly flagged by an AI screening tool, a community or advocacy group acting on behalf of affected people, a journalist, or a regulator. Any of them might notice an adverse impact, meaning a bad effect on a person, group, or the wider community, such as an unfair or discriminatory outcome, a privacy breach, a safety problem, or AI-generated content that is harmful or misleading. The control asks you to provide a capability, a real, working channel, that these outside parties can find and use to report those adverse impacts to you. In practice that usually means a clearly published reporting route, such as a web form, an email address, or a phone line, that does not require the person to already be a customer or to log in to your system. It needs to be easy to find (for example linked from the page or product where the AI is used) and it needs someone behind it who reads what comes in, records it, and follows up. The point is that the people best placed to spot when an AI is harming someone are often the people on the receiving end, and they are frequently not your customers at all. Without a way for them to reach you directly, their only options are to complain to a regulator or go public. This control closes that gap by giving them a front door.

Why it matters

If there is no external way to report harm, an affected member of the public, say someone wrongly refused a service by an automated decision with no customer account to log a complaint, has nowhere to turn except the OAIC or the media. A pattern of adverse impacts can then run for months unseen by the organisation, surfacing first as a regulator's enquiry or a news story rather than a report you could have acted on early. The same blind spot can let a discriminatory or unsafe AI outcome keep harming a cohort of people before anyone inside the organisation hears about it.

How to implement

  1. The AI system owner should set up a reporting channel that anyone outside the organisation can reach, such as a public web form or a monitored email address like ai-concerns@, that does not require the reporter to be a customer or to log in, since the people harmed by an AI decision are often not your customers at all.

  2. Whoever owns the public website or product should publish the channel where affected people will actually see it, for example linking it from the page where the AI is used and from your privacy or AI transparency notice, so an affected member of the public or an advocacy group can find it quickly.

  3. A named owner, such as a compliance or AI governance lead, should monitor incoming reports, acknowledge each one, and record the date, the reporter, the adverse impact described, and the action taken in a simple register so nothing falls through the cracks.

  4. The same owner should route each reported adverse impact to whoever assesses AI impacts in your organisation, give the reporter a response where appropriate, and watch for repeated or widespread reports that signal a systemic problem needing escalation.

  5. The AI governance lead should periodically test the channel from an outsider's point of view, submitting a sample report as a non-customer would, to confirm it is reachable, monitored, and still published correctly after any website or product change.

Keep it running

Treat the reporting channel itself as something to keep alive: check the inbox, form, or hotline is actually monitored, that submissions are not silently bouncing, and that the published link still works after site or product changes. Acknowledge each report and route it to whoever assesses adverse impacts, and keep a simple log of who reported, what the impact was, and how it was resolved. Periodically test the channel from outside, as a non-customer would, to confirm a member of the public can find and use it without a login.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask to see the actual channel the organisation provides for external parties to report adverse impacts of the AI system, and where it is published.

    Look at

    Whether a member of the public who is not a customer could find and use it without a login, for example a web form or email address linked from the AI-facing page or a transparency notice.

    Good evidence

    There is a clearly published, externally reachable reporting channel that any interested party, not just customers, can use without an account.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Request the log or register of adverse-impact reports received from outside the organisation over the last year.

    Look at

    Whether entries record the date, who reported, the adverse impact described, and the follow-up action, and whether reporters include non-customers such as members of the public or advocacy groups.

    Good evidence

    The log shows real reports from external parties, each with the impact recorded and a documented follow-up and resolution.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask to speak to the person who monitors the external reporting channel, or ask the organisation to walk through one report from an external party end to end.

    Look at

    Whether the channel is genuinely monitored, how quickly reports are acknowledged, and who decides what to do about a reported adverse impact.

    Good evidence

    A named owner monitors the channel, acknowledges reports promptly, and routes each to whoever assesses and responds to the adverse impact.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask how the organisation makes sure the reporting capability stays available and known to interested parties, and request any test or review records.

    Look at

    Whether someone periodically checks the channel works from outside and that the published link or address is still live after website or product changes.

    Good evidence

    The channel is tested from an external viewpoint and confirmed reachable, with records showing it is kept published and working.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask which categories of interested parties the reporting capability is meant to serve, and how they are made aware of it.

    Look at

    Whether the organisation has considered a broad set, such as affected members of the public, advocacy groups and regulators, rather than only existing customers.

    Good evidence

    The organisation identifies a broad set of interested parties and shows how each can find and use the reporting channel.

Mappings

Closest match in ISO/IEC 27001: A.6.8, Mechanisms for reporting security events, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.6.8Mechanisms for reporting security eventsPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.

Get help with this control

ISO 42001 training

Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.

PolicyMint

Turn this control into your AI policy

PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.

Draft your ISO 42001 documents