ISO 42001 A.3: Internal organization
Roles, responsibilities, reporting
AIGE-OBL-ISO42001-A3. Drawn from chapter 08.
Text alternative
- Clause: ISO 42001, A.3.
- Duty holder: Not stated.
- Applies from: No date, Voluntary.
- Artefact: Operating model.
- Layers: Layer 01, Layer 02.
- Evidence record: Evidence record v1.
- Record schema: Evidence record.
- The same topic in 20 other frameworks; the crosswalk section below links each clause.
- Id
AIGE-OBL-ISO42001-A3- Instrument
- ISO/IEC 42001 standard
- Compared side by side
- ISO 42001 vs EU AI Act · NIST AI RMF vs ISO 42001
- Clause
- A.3
- Applies from
- No date Voluntary · Voluntary management-system standard (2023); no presumption of conformity
The artefact that evidences it
Operating model; RACI; ownership in the registry.
Data table: every relation
| Family | Item | Relation |
|---|---|---|
| Same crosswalk topic | AI Verify 9.1.1, 9.5.2 | Core clause |
| Same crosswalk topic | CSA AICM GRC-01, GRC-06 | Core clause |
| Same crosswalk topic | China Algo. Rec. AlgoRec Art. 7 | Core clause |
| Same crosswalk topic | China Deep Synthesis DeepSyn Art. 7 | Core clause |
| Same crosswalk topic | China GenAI Measures GenAI Art. 9 | Core clause |
| Same crosswalk topic | EU AI Act Art. 17, Art. 4, Art. 87 | Core clause |
| Same crosswalk topic | GAO AI Accountability 1.2, 1.1, 1.3 | Core clause |
| Same crosswalk topic | GDPR Art. 5(2) | Core clause |
| Same crosswalk topic | ISO 42001 5.1, 5.2, 5.3, A.2, 9.3, 7.2, 9.2, 10.1 | Core clause |
| Same crosswalk topic | NIST AI RMF GOVERN 1, GOVERN 2, GOVERN 4, GOVERN 5 | Core clause |
| Same crosswalk topic | OECD AI Principles OECD 1.5 | Core clause |
| Same crosswalk topic | Singapore Agentic Agentic 2.2.1 | Core clause |
| Same crosswalk topic | Singapore GenAI GenAI 1 | Core clause |
| Same crosswalk topic | TC260 Framework 3.0 TC260 4, TC260 5.3.12 | Core clause |
| Same crosswalk topic | UK ATRS ATRS 2.1 | Core clause |
| Same crosswalk topic | CoE Convention CoE Art. 9 | Related clause |
| Same crosswalk topic | EN 18286 EN 18286 | Related clause |
| Same crosswalk topic | G7 Code G7 Action 5 | Related clause |
| Same crosswalk topic | GPAI Code Safety C8 | Related clause |
| Same crosswalk topic | Korea AI Act Art. 36 | Related clause |
Patterns that build it
No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Governance and accountability
- EU AI Act Art. 17 Quality management system (core)
- ISO 42001 5.1 Leadership and commitment (core)
- ISO 42001 5.2 AI policy (core)
- ISO 42001 5.3 Roles, responsibilities and authorities (core)
- ISO 42001 A.2 Policies related to AI (core)
- NIST AI RMF GOVERN 1 GOVERN 1: Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively (core)
- NIST AI RMF GOVERN 2 GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained (core)
- TC260 Framework 3.0 TC260 4 Comprehensive governance measures (core)
- TC260 Framework 3.0 TC260 5.3.12 Traceable chain of responsibility (core)
- China GenAI Measures GenAI Art. 9 Provider responsibility as content producer (core)
- China Algo. Rec. AlgoRec Art. 7 Algorithm-security responsibility system (core)
- China Deep Synthesis DeepSyn Art. 7 Information-security responsibility system (core)
- GDPR Art. 5(2) Accountability (core)
- ISO 42001 9.3 Management review (core) (clause not verified)
- CSA AICM GRC-01 Governance Program Policy and Procedures (core)
- CSA AICM GRC-06 Governance Responsibility Model (core)
- UK ATRS ATRS 2.1 Owner and responsibility (core)
- Singapore GenAI GenAI 1 Accountability (core)
- Singapore Agentic Agentic 2.2.1 Clear allocation of responsibilities within and outside the organisation (core)
- OECD AI Principles OECD 1.5 Accountability (core)
- GAO AI Accountability 1.2 Roles and responsibilities: define clear roles, responsibilities, and delegation of authority for the AI system (core)
- AI Verify 9.1.1 Accountability: establish policies on the development and use of AI aligned with other organisational policies (core)
- AI Verify 9.5.2 Accountability: clear internal governance mechanisms and roles, including a cross-departmental AI governance committee (core)
- EU AI Act Art. 4 AI literacy
- EU AI Act Art. 87 Reporting of infringements and protection of reporting persons
- ISO 42001 7.2 Competence (clause not verified)
- ISO 42001 9.2 Internal audit (clause not verified)
- ISO 42001 10.1 Continual improvement (clause not verified)
- NIST AI RMF GOVERN 4 GOVERN 4: Organizational teams are committed to a culture that considers and communicates AI risk
- NIST AI RMF GOVERN 5 GOVERN 5: Processes are in place for robust engagement with relevant AI actors
- GPAI Code Safety C8 Commitment 8: Systemic risk responsibility allocation
- Korea AI Act Art. 36 Domestic representative
- CoE Convention CoE Art. 9 Accountability and responsibility
- G7 Code G7 Action 5 Develop, implement and disclose AI governance and risk-management policies
- EN 18286 EN 18286 Quality management system for EU AI Act regulatory purposes
- GAO AI Accountability 1.1 Clear goals: define clear goals and objectives for the AI system
- GAO AI Accountability 1.3 Values: demonstrate a commitment to values and principles established by the entity
Source
Chapter 08, section ISO/IEC 42001, 42005 and 42006, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-iso42001-a3.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). ISO 42001 A.3: Internal organization (AIGE-OBL-ISO42001-A3). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a3. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{ISO 42001 A.3: Internal organization (AIGE-OBL-ISO42001-A3)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a3},
note = {Version 0.5.0}
}