ISO 42001 Annex A 8.5 Determine and document AI reporting obligations to interested parties
What it says
The organization shall determine and document their obligations to reporting information about the AI system to interested parties.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation must identify and write down every obligation it has to report information about its artificial intelligence (AI) systems to interested parties.
This control is about working out who you owe information to about your artificial intelligence (AI) systems, and writing those obligations down so nothing slips through the cracks. Interested parties are any people or groups who have a stake in your AI, such as customers, regulators, business partners, suppliers, employees, or members of the public affected by a decision the AI makes. Some of these reporting duties are legal, for example a privacy regulator that requires you to disclose how automated decisions are made, or a law that says a person must be told when they are interacting with AI rather than a human. Others come from contracts, industry codes, or promises your organisation has made. The point of this control is not to decide what you report yet, but first to make a complete and documented list of who you are obliged to inform, what you must tell them, and why that obligation exists. Without that documented list, it is easy to miss a legal duty or break a contract, which can lead to fines, complaints, or loss of trust. Within your AI management system (AIMS, the set of policies and processes you use to govern AI responsibly), this documented register of reporting obligations becomes the foundation for actually delivering the right information to the right people at the right time.
Free. Save your status, tasks and notes.
Why it matters
Missing a documented reporting obligation can breach a law or contract, leading to regulator fines, complaints, and lost trust in your AI.
How to implement
The compliance manager compiles a register that lists every interested party your AI systems affect, such as customers, regulators, partners and the public, and records what reporting obligation is owed to each one.
The legal team reviews applicable laws, regulations and industry codes covering AI and automated decisions, then documents each specific reporting duty they create along with the source it comes from.
The contracts owner examines supplier and customer agreements to find clauses that require you to share information about the AI system, and adds those contractual reporting obligations to the same register.
The AI management system owner assigns a named person responsible for each documented obligation and sets a defined frequency for review, so the register stays current as systems, laws and contracts change.
The board or senior leadership formally approves the documented reporting obligations and confirms the organisation has the resources to meet them, recording that approval in meeting minutes.
Keep it running
Review the obligations register whenever laws, contracts or AI systems change, not only at audit time, and reassign owners when staff move on.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
the documented register or list of reporting obligations the organisation owes to interested parties about its AI systems, and confirm it actually exists in writing.
Look at
whether the register names each interested party, states what information must be reported to them, and cites the source of the obligation such as a specific law, regulation or contract clause.
- Check 2 of 2What an auditor asks for
Ask for
how the organisation identified its legal and regulatory reporting duties, and check that the legal review covering AI and automated decisions is documented and reasonably current.
Look at
supplier and customer contracts to confirm any reporting clauses they contain have been captured in the register, with no obvious obligations missing.
Good evidence
a complete, dated and approved register with a named owner and review date for each obligation, kept up to date as laws, contracts and AI systems change.
Mappings
Closest match in ISO/IEC 27001: A.5.31, Compliance with information security legal requirements, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.31.
Annex A 8.5 requires the organisation to determine and document obligations to report information about AI systems to interested parties. Annex A 5.31 requires identification, documentation and maintenance of legal, statutory, regulatory and contractual information security requirements. The overlap is in identifying and documenting externally imposed reporting obligations, but Annex A 8.5 is AI-specific, while Annex A 5.31 is broader.
This control partially overlaps A.5.34.
Annex A 8.5 requires determining and documenting obligations to report AI system information to interested parties. Annex A 5.34 involves privacy compliance, often including reporting obligations when AI systems handle PII. The overlap is on external disclosure obligations linked to PII, but Annex A 8.5 includes broader AI reporting contexts.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-0043.
Annex A 8.5 requires determining and documenting obligations to report information about the AI system to interested parties. ISM-0043 requires a cyber security incident response plan that explicitly includes how to report incidents internally and externally to relevant authorities and other parties that need to be informed. The overlap is on defining who must be informed and reporting pathways, but ISM-0043 is limited to cyber incidents, whereas Annex A 8.5 covers broader AI reporting obligations (including non-incident reporting such as disclosures, governance reporting, or user communications).
This control partially overlaps ISM-1478.
Annex A 8.5 requires the organisation to determine and document obligations to report AI systems information. ISM-1478 places accountability on the CISO for compliance, which may include AI-related disclosures. The overlap is on governance-driven compliance, but Annex A 8.5 is AI-specific, whereas ISM-1478 is broader.
This control partially overlaps ISM-1880.
Annex A 8.5 requires determining and documenting AI reporting obligations. ISM-1880 mandates reporting of cyber incidents affecting customer data, which could apply if AI systems handling such data are involved in an incident. The overlap is on external reporting obligations, but ISM-1880 is incident-specific, while Annex A 8.5 is broader.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents