# ISO/IEC 42001 A.6.1.2 — Objectives for responsible development of AI systems

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_iso42001_a612_1c6c32fad7-isoiec-42001-a612-objectives-for-responsible-development-of-ai-systems
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [ISO/IEC 42001 (AI Management System)](https://support.icompaas.com/support/solutions/c_gen_iso42001) › [Technological controls](https://support.icompaas.com/support/solutions/folders/f_gen_cgeniso42001_technologicalcontrols)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

ISO/IEC 42001 · Control A.6.1.2 · Priority: high · Component: Technological controls

### What this control covers

Objectives for responsible AI development shall be defined, measurable where practical, and integrated into AI lifecycle governance.

### Why it matters

Vulnerabilities introduced in code are 100× cheaper to fix in development than in production; this control is the place where security shifts left.

### How to implement

#### AWS

Use **CodeBuild** with [VPC-isolated](https://aws.amazon.com/codebuild/) build environments and **CodeArtifact** for an internal package mirror so builds don't pull straight from the public registry. Sign artefacts with **AWS Signer**.

#### Azure

Use **Azure DevOps Pipelines** with mandatory approvals on production environments and **Microsoft Defender for DevOps** for secret scanning across GitHub/ADO/GitLab in one pane.

#### GCP

**Vertex AI Model Registry** with model-card metadata, **Model Garden** for vetted base models, and **Sensitive Data Protection** on training/inference inputs.

#### GitHub

Apply **branch protection** on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use **CODEOWNERS** for required reviewers, **Dependabot** + **CodeQL** for SAST, and the **Dependency graph / SBOM** export for vendor disclosures.

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.
-   `code_repo_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Approved governance objectives should define measurable or reviewable expectations for responsible AI development. Repository and lifecycle evidence should demonstrate those objectives are embedded in development planning, review, and implementation activities. Focus: Objectives for responsible development of AI systems.

### Quick checklist

-   Define — Ai Systems / Governance
-   Develop — Ai Systems / Governance
-   Govern — Ai Systems / Governance

### Related articles on this site

-   [S3 Lifecycle Management](https://support.icompaas.com/support/solutions/articles/62000218667-s3-lifecycle-management)
-   [Employee Lifecycle Management](https://support.icompaas.com/support/solutions/articles/62000225222-employee-lifecycle-management)
-   [NIST 800-171 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.](https://support.icompaas.com/support/solutions/articles/62000229280-nist-800-171-3-4-1-establish-and-maintain-baseline-configurations-and-inventories-of-organizational-s)
-   [NIST 800-171 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems.](https://support.icompaas.com/support/solutions/articles/62000229281-nist-800-171-3-4-2-establish-and-enforce-security-configuration-settings-for-information-technology-p)