What roles and responsibilities does ISO/IEC 42001 require for an AI management system?

ISO/IEC 42001 requires top management to assign roles, responsibilities, and authorities for AI governance, and for the organization to define and resource AI roles, responsibilities, and reporting lines.

Specifically, the standard outlines the following controls related to roles and responsibilities:

• ISO/IEC 42001 Cl.5 Leadership mandates that top management demonstrates leadership by assigning roles, responsibilities, and authorities for AI governance. This cross-maps to NIST-GOVERN-1/2.
• ISO/IEC 42001 A.3 Internal organization requires that AI roles, responsibilities, and reporting lines are defined and resourced. This control is probed by the m2_roles_responsibilities questionnaire item.
• ISO/IEC 42001 Cl.7 Support requires that resources, competence, awareness, communication, and documented information control are provided to operate the AI Management System (AIMS). This implies that individuals with appropriate competence are assigned to roles within the AIMS.
• NIST-GOVERN-2.1, which cross-maps to ISO/IEC 42001, further specifies that roles and responsibilities and lines of communication for AI risk should be documented and clear, and a named risk owner/accountable executive should exist for each deployed AI/agent system.