A.8.4·high·Component: Organizational controlsWhat this control requires
AI-related incidents and significant events shall be communicated to relevant stakeholders in a timely and controlled manner.
In plain English
AI-related incidents and significant events shall be communicated to relevant stakeholders in a timely and controlled manner. In practice, this means you can prove you communicate incidents-level controls on a defined cadence.
Why it matters
ISO 42001 is the first audited evidence regulators, customers and investors can ask for that you are managing AI risk. Each Annex A control is a check-box in that audit; it is also the management system enterprises are starting to require from AI vendors before an MSA can be signed.
This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.
What an auditor looks for
An ISO 42001 auditor verifies you have an AI policy, a risk-based system of impact assessments for each AI system, lifecycle controls from data acquisition through retirement, and third-party-AI controls that pierce the vendor's wrapper to underlying model behaviour.
Within Organizational controls, the assessor will trace your implementation back to the catalogue reference (Annex A A.8.4) and look for objective evidence on the latest two assessment cycles.
How to implement
Incident Response
Runbook. Maintain a runbook keyed by incident type with named roles (IC, comms, scribe), an out-of-band comms channel, and a 72-hour timeline for external notification.
Tabletop. Run a quarterly tabletop exercise (ransomware, insider, supply-chain) and feed gaps back into the runbook.
Policy Management
Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.
Operational checklist
- Communicate. Document the trigger, the owner and the cadence.
- Scope: incidents.
Evidence to collect
- Ticketing Workflow.
ticketing_workflowevidence - Policy Document. A signed and version-controlled policy / standard / procedure document.
Workflow evidence should demonstrate communication of AI-related incidents and significant events to relevant stakeholders, while policies define timeliness, ownership, and escalation criteria. Focus: Communication of incidents.
Common pitfalls
- Runbooks that name a role but no person, or list a paging channel that no longer exists.
- Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.
How it maps to other frameworks
Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.
- ISO/IEC 27001:2022 A.5.24 — Information security incident management planning and preparation
- ISO/IEC 27701:2025 A.3.12 — Response to incidents
- CIS Controls v8 17.4 — Establish and Maintain an Incident Response Process
- BSI C5:2020 SIM-01 — Policy for security incident management
Related controls in ISO/IEC 42001:2023
- Annex A A.8.3 — External reporting
- Annex A A.3.3 — Reporting of concerns
- Annex A A.8.5 — Information for interested parties
- Annex A A.2.2 — Policies for the responsible development or use of AI systems
- Annex A A.2.3 — Alignment with other organizational policies
- Annex A A.2.4 — Review of policies for responsible AI
References
- ISO/IEC JTC 1/SC 42 — ISO/IEC 42001:2023
- Catalogue identifier:
Annex A A.8.4
Topics: incident responsestakeholder communicationgovernance riskevent alertpolicy management