ISO 42001 A.8: Information for interested parties
Transparency and reporting to stakeholders
AIGE-OBL-ISO42001-A8. Drawn from chapter 08.
Text alternative
- Clause: ISO 42001, A.8.
- Duty holder: Not stated.
- Applies from: No date, Voluntary.
- Artefact: Model/data cards.
- Layer: Layer 02 Inventory & Transparency.
- Evidence record: Model card, +1 more.
- Record schemas: Model card , Instructions for use .
- The same topic in 22 other frameworks; the crosswalk section below links each clause.
- Id
AIGE-OBL-ISO42001-A8- Instrument
- ISO/IEC 42001 standard
- Compared side by side
- ISO 42001 vs EU AI Act · NIST AI RMF vs ISO 42001
- Clause
- A.8
- Applies from
- No date Voluntary · Voluntary management-system standard (2023); no presumption of conformity
The artefact that evidences it
Model/data cards; machine-readable disclosures.
Data table: every relation
| Family | Item | Relation |
|---|---|---|
| Patterns | Claims Substantiation Gate | Direct |
| Patterns | Decision Notice & Contest Path | Direct |
| Patterns | Disclosure & Notification Pipeline | Direct |
| Patterns | Downstream Use Register | Direct |
| Patterns | Explanation Artefact | Direct |
| Open controls | AIGE-CTL-EVAL-007 Incident Evidence Preservation | Direct |
| Open controls | AIGE-CTL-DATA-012 Registered Downstream Consumers of Outputs | Direct |
| Same crosswalk topic | AI Verify 1.1.6, 1.7.2, 1.1.1, 9.5.4, 1.5.1, 1.6.1, 5.11.1, 2.2.1, 1.1.4 | Core clause |
| Same crosswalk topic | CSA AICM MDS-03, MDS-04, SEF-07, SEF-08, GRC-13, GRC-14 | Core clause |
| Same crosswalk topic | China AI Labelling Label Art. 4, Label Art. 5 | Core clause |
| Same crosswalk topic | China Deep Synthesis DeepSyn Art. 16, DeepSyn Art. 17 | Core clause |
| Same crosswalk topic | China GenAI Measures GenAI Art. 12, GenAI Art. 19, GenAI Art. 14, GenAI Art. 15 | Core clause |
| Same crosswalk topic | CoE Convention CoE Art. 14(2), CoE Art. 15(2) | Core clause |
| Same crosswalk topic | EU AI Act Art. 11, Art. 13, Art. 53, Art. 50, Art. 86, Art. 18, Art. 43, Art. 53(1)(d), Art. 50(2), 50(4), Art. 72, Art. 73, Art. 26(5), Art. 55, Art. 3(49), Art. 20, Art. 13(3)(b)(iv)–(v) | Core clause |
| Same crosswalk topic | G7 Code G7 Action 3, G7 Action 2, G7 Action 4 | Core clause |
| Same crosswalk topic | GAO AI Accountability 1.9, 3.5, 1.7, 4.1, 4.2 | Core clause |
| Same crosswalk topic | GDPR Arts. 13–14, Art. 30, Arts. 33–34, Art. 15(1)(h), Art. 13(2)(f), Art. 22(3) | Core clause |
| Same crosswalk topic | GPAI Code Transparency 1.1, Transparency 1.2, Safety C9, Safety 3.5 | Core clause |
| Same crosswalk topic | ISO 42001 7.5, A.6, 10.2 | Core clause |
| Same crosswalk topic | Korea AI Act Art. 31, Art. 34(1)(2), Art. 32(1) | Core clause |
| Same crosswalk topic | NIST AI RMF MAP 1, MEASURE 2.8, MAP 1.6, MEASURE 2.9, MANAGE 4, MANAGE 4.3, MANAGE 2.4, GOVERN 4.3 | Core clause |
| Same crosswalk topic | OECD AI Principles OECD 1.3 | Core clause |
| Same crosswalk topic | Singapore Agentic Agentic 2.3.3 | Core clause |
| Same crosswalk topic | Singapore GenAI GenAI 3, GenAI 4 | Core clause |
| Same crosswalk topic | TC260 Framework 3.0 TC260 5.3.7, TC260 5.3.18, TC260 App. 2 II.6 | Core clause |
| Same crosswalk topic | UK ATRS ATRS Tier 1, ATRS 2.2, ATRS 2.3.5 | Core clause |
| Same crosswalk topic | UK DUAA UK GDPR Art. 22C | Core clause |
| Same crosswalk topic | China Algo. Rec. AlgoRec Art. 16, AlgoRec Art. 7, AlgoRec Art. 17 | Related clause |
| Same crosswalk topic | GB/T 45654 GB/T 45654 Content labelling | Related clause |
Patterns that build it
- Explanation Artefact (layer 4 and 5)
- Claims Substantiation Gate (layer 5 and 3)
- Decision Notice & Contest Path (layer 4 and 5)
- Downstream Use Register (layer 2 and 1)
- Disclosure & Notification Pipeline (layer 5 and 2)
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Documentation and transparency
- EU AI Act Art. 11 Technical documentation (core)
- EU AI Act Art. 13 Transparency and provision of information to deployers (core)
- EU AI Act Art. 53 Obligations for providers of general-purpose AI models (core)
- ISO 42001 7.5 Documented information (core)
- ISO 42001 A.6 AI system life cycle (core)
- China AI Labelling Label Art. 4 Explicit labels for generated content (core)
- China AI Labelling Label Art. 5 Implicit (metadata) labels (core)
- China GenAI Measures GenAI Art. 12 Labelling of generated content (core)
- China Deep Synthesis DeepSyn Art. 16 Implicit technical labels (core)
- China Deep Synthesis DeepSyn Art. 17 Conspicuous labels for confusable content (core)
- GPAI Code Transparency 1.1 Drawing up and keeping up-to-date model documentation (core)
- GDPR Arts. 13–14 Information to be provided to the data subject (core)
- CSA AICM MDS-03 Model Documentation (core)
- Korea AI Act Art. 31 Transparency: prior notice, output labelling, realistic synthetic content (core)
- UK ATRS ATRS Tier 1 Summary information (core)
- Singapore GenAI GenAI 3 Trusted Development and Deployment (core)
- CoE Convention CoE Art. 14(2) Documentation sufficient to contest decisions; complaint to authorities (core)
- OECD AI Principles OECD 1.3 Transparency and explainability (core)
- G7 Code G7 Action 3 Publicly report capabilities, limitations and domains of use (core)
- GAO AI Accountability 1.9 Transparency: enable external stakeholders to access information on the design, operation, and limitations of the AI system (core)
- GAO AI Accountability 3.5 Documentation: document the methods for assessment, performance metrics, and outcomes of the AI system (core)
- AI Verify 1.1.6 Transparency: publicly report accuracy, intended use cases, limitations, risk assessment and mitigations to stakeholders (core)
- AI Verify 1.7.2 Transparency: make model or system cards publicly available where warranted by public interest (core)
- EU AI Act Art. 50 Transparency obligations for providers and deployers of certain AI systems
- NIST AI RMF MAP 1 MAP 1: Context is established and understood
- NIST AI RMF MEASURE 2.8 MEASURE 2.8: Risks associated with transparency and accountability are examined and documented
- China GenAI Measures GenAI Art. 19 Disclosure to regulators
- China Algo. Rec. AlgoRec Art. 16 Notice that recommendation is used
- GB/T 45654 GB/T 45654 Content labelling Generated-content labelling requirements (clause not verified)
- EU AI Act Art. 86 Right to explanation of individual decision-making
- EU AI Act Art. 18 Documentation keeping
- EU AI Act Art. 43 Conformity assessment
- EU AI Act Art. 53(1)(d) Public summary of the content used for training
- EU AI Act Art. 50(2), 50(4) Machine-readable marking of synthetic content; disclosure of deep fakes
- GPAI Code Transparency 1.2 Providing relevant information
- GDPR Art. 30 Records of processing activities
- NIST AI RMF MAP 1.6 MAP 1.6: System requirements are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks
- NIST AI RMF MEASURE 2.9 MEASURE 2.9: The AI model is explained, validated, and documented, and AI system output is interpreted within its context as identified in the MAP function to inform responsible use and governance
- CSA AICM MDS-04 Model Documentation Requirements
- Korea AI Act Art. 34(1)(2) Explanation plan: result, main criteria, training-data overview
- UK ATRS ATRS 2.2 Description and rationale
- CoE Convention CoE Art. 15(2) Notification of interaction with an AI system
- GAO AI Accountability 1.7 Specifications: establish and document technical specifications
- AI Verify 1.1.1 Transparency: design an in-house policy on communication to consumers that articulates the principles for transparency
Incident response and monitoring
- EU AI Act Art. 72 Post-market monitoring by providers and post-market monitoring plan (core)
- EU AI Act Art. 73 Reporting of serious incidents (core)
- ISO 42001 10.2 Nonconformity and corrective action (core)
- NIST AI RMF MANAGE 4 MANAGE 4: Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored (core)
- TC260 Framework 3.0 TC260 5.3.7 Real-time risk monitoring (core)
- TC260 Framework 3.0 TC260 5.3.18 Incident reporting (core)
- China GenAI Measures GenAI Art. 14 Handle and report unlawful content (core)
- China GenAI Measures GenAI Art. 15 Complaint and reporting mechanism (core)
- EU AI Act Art. 26(5) Deployer monitoring, informing the provider and suspending use (core)
- GPAI Code Safety C9 Commitment 9: Serious incident reporting (core)
- GDPR Arts. 33–34 Notification and communication of a personal data breach (core)
- NIST AI RMF MANAGE 4.3 MANAGE 4.3: Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented (core)
- CSA AICM SEF-07 Incident Management and Response (core)
- CSA AICM SEF-08 Security Breach Notification (core)
- Korea AI Act Art. 32(1) Safety duties for AI above the compute threshold (core)
- Singapore GenAI GenAI 4 Incident Reporting (core)
- Singapore Agentic Agentic 2.3.3 When deploying, continuously monitor and test (core)
- G7 Code G7 Action 2 Identify and mitigate vulnerabilities, incidents and misuse after deployment (core)
- G7 Code G7 Action 4 Responsible information sharing and reporting of incidents (core)
- GAO AI Accountability 4.1 Planning: develop plans for continuous or routine monitoring of the AI system (core)
- GAO AI Accountability 4.2 Drift: establish the range of data and model drift that is acceptable (core)
- AI Verify 9.5.4 Accountability: enable an incident management process to report and respond to actions or decisions that affect the AI system's outcome (core)
- AI Verify 1.5.1 Transparency: communicate to end users whenever an incident has occurred (core)
- EU AI Act Art. 55 Obligations for providers of general-purpose AI models with systemic risk
- TC260 Framework 3.0 TC260 App. 2 II.6 Emergency plans
- China Algo. Rec. AlgoRec Art. 7 Security management and emergency response
- EU AI Act Art. 3(49) Definition of serious incident
- EU AI Act Art. 20 Corrective actions and duty of information
- GPAI Code Safety 3.5 Measure 3.5: Post-market monitoring
- NIST AI RMF MANAGE 2.4 MANAGE 2.4: Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use
- NIST AI RMF GOVERN 4.3 GOVERN 4.3: Organizational practices are in place to enable AI testing, identification of incidents, and information sharing
- AI Verify 1.6.1 Transparency: give end users and external parties the means to report adverse impacts, with whistleblower protection
- AI Verify 5.11.1 Security: monitor AI system outputs and behaviour after deployment and alert system owners to issues
Explainability and right to explanation
- EU AI Act Art. 86 Right to explanation of individual decision-making (core)
- EU AI Act Art. 13(3)(b)(iv)–(v) Information relevant to explain output; performance for specific persons or groups (core)
- GDPR Art. 15(1)(h) Meaningful information about the logic involved (core)
- NIST AI RMF MEASURE 2.9 MEASURE 2.9: The AI model is explained, validated, and documented, and AI system output is interpreted within its context as identified in the MAP function to inform responsible use and governance (core)
- CSA AICM GRC-13 Explainability Requirement (core)
- CSA AICM GRC-14 Explainability Evaluation (core)
- Korea AI Act Art. 34(1)(2) Explanation plan: result, main criteria, training-data overview (core)
- UK DUAA UK GDPR Art. 22C Safeguards for automated decision-making (core)
- OECD AI Principles OECD 1.3 Transparency and explainability (core)
- AI Verify 2.2.1 Explainability: document the rationale and trade-offs of a less explainable model and apply explainable AI techniques (core)
- AI Verify 1.1.4 Transparency: tell people using or affected by the system the factors behind a decision and that it was made wholly or partly by an automated system (core)
- GDPR Art. 13(2)(f) Existence of automated decision-making
- GDPR Art. 22(3) Right to obtain human intervention and to contest the decision
- NIST AI RMF MEASURE 2.8 MEASURE 2.8: Risks associated with transparency and accountability as identified in the MAP function are examined and documented
- UK ATRS ATRS 2.3.5 Appeals and review
- Singapore GenAI GenAI 3 Trusted Development and Deployment
- CoE Convention CoE Art. 14(2) Documentation sufficient to contest decisions; complaint to authorities
- China Algo. Rec. AlgoRec Art. 17 Explain where an algorithm significantly affects user rights
Open controls that evidence it
Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.
-
AIGE-CTL-EVAL-007Incident Evidence Preservation (Evaluation environment profile) -
AIGE-CTL-DATA-012Registered Downstream Consumers of Outputs (Data admission and privacy profile)
Source
Chapter 08, section ISO/IEC 42001, 42005 and 42006, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-iso42001-a8.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). ISO 42001 A.8: Information for interested parties (AIGE-OBL-ISO42001-A8). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a8. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{ISO 42001 A.8: Information for interested parties (AIGE-OBL-ISO42001-A8)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a8},
note = {Version 0.5.0}
}