ISO 42001 Clause 7.2: Demonstrate Competence for AI Responsibilities
ISO 42001 clause 7.2 requires the organisation to determine necessary competence for people under its control whose work affects AI performance. It ensures competence through suitable education, training or experience, takes development action where applicable and evaluates that action's effectiveness. Appropriate documented evidence of competence must be available.
What clause 7.2 requires in practice
Clause 7.2 sets four expectations for people who do work under the organisation's control that affects its AI performance. The organisation determines what competence they need. It makes sure they are competent, judged by suitable education, training or experience. Where competence is missing, it takes action to acquire it, and it evaluates whether those actions worked. Appropriate documented information must be available as evidence of competence.
Notes add helpful context. Guidance on human resources and necessary expertise is found in Annex B, control B.4.6. Actions can include training, mentoring, reassignment, hiring or contracting competent people. The wording covers contractors and others working under the organisation's control, not just employees. Competence means being able to apply knowledge and skills to reach intended results, so attending a course is not by itself enough. The standard sets no qualification, pass mark or fixed training format.
Describe capability in terms of the task
A useful competence statement explains what someone needs to recognise, decide or perform. “Understands AI” is too broad for a person reviewing customer advice or assessing a consequential use. Describe the actual responsibility and operating conditions before choosing a course.
Different roles require different capabilities. An employee checking an AI draft needs knowledge of the subject and escalation route. An impact assessor needs methods for examining affected-party consequences. A technical evaluator may need specialist knowledge that a general awareness course cannot provide. These are practical distinctions, not mandatory job titles.
Why competence matters to the business
AI controls are performed by people. A reviewer who cannot recognise the defect a control is meant to catch gives false comfort, and an assessor lacking domain or linguistic knowledge can miss consequential differences in results. Defining competence by task helps the organisation invest in learning that changes performance rather than in generic courses. It protects individuals from being blamed for limits of their preparation and gives managers a rational basis for deciding who may approve, assess or review. When customers ask who is qualified to oversee their data and decisions, a clear competence picture is a credible and reassuring answer.
How to implement clause 7.2
Describe capability in terms of what a person must recognise, decide or do, then match development to the gap.
- Identify roles whose work affects AI performance, including reviewers, assessors, developers, procurement and supervisors, and contractors where relevant.
- For each role, write the specific capabilities needed, for example recognising unsupported statements or assessing consequences for affected groups.
- Compare current people with the requirements using evidence such as qualifications, experience and observed work.
- Choose development actions that fit the gap, whether instruction, supervised practice, mentoring, reassignment or external support.
- Evaluate whether the action worked, for instance through an observed task or review of completed work using representative examples.
- Keep proportionate records that show the link between the person, the task and the evidence.
- Reconsider competence when a role changes, such as an internal tool becoming customer-facing.
- Ask line managers to flag tasks where the person doing the work lacks confidence, and use these signals to refine the competence requirements.
Illustrative manufacturing example: reviewing an uncertain inspection
A manufacturer routes uncertain AI inspection results to an operator. The operator has completed an introduction to the tool but cannot reliably distinguish the defect that the control is intended to catch. Attendance proves participation, not the required review capability.
The organisation clarifies the task, arranges suitable instruction and supervised practice, and examines performance using representative examples. It also checks that the operator receives adequate images and information. A competence assessment should not blame the person for a limitation caused by an unsuitable review interface.
Illustrative software example: assessing a new population
A software team extends an AI support feature to a new language. Its developers understand the system architecture but lack the linguistic and domain knowledge needed to evaluate consequential answer differences. The team obtains appropriate input rather than assume that technical experience covers every assessment dimension.
The organisation records why the selected people are suitable for their respective tasks. It also identifies limits: an evaluator can assess defined performance characteristics without being qualified to interpret every jurisdictional obligation. Recognising the need for specialist help is part of a credible arrangement.
Choose development actions and examine results
Training can be effective where knowledge or skills need development. Mentoring, supervised application, reassignment or obtaining competent external help may also be appropriate. Select the action from the identified need rather than send every role to the same course.
Where development action is taken, evaluate whether it worked. A short exercise, observed task or review of completed work may provide relevant evidence. The method should fit the consequence of error and the responsibility; the standard does not prescribe a universal examination or pass mark.
Keep evidence proportionate and current
Required competence evidence can draw on qualifications, relevant experience, demonstrated work and evaluated development. Explain its relevance to the assigned task. A folder of certificates with no link to responsibilities can obscure important gaps.
Reconsider competence when the task changes. An employee capable of checking an internal draft may need additional capability when the output becomes customer-facing or affects a different decision. Connect role changes with assigned responsibilities and human resource controls.
Common mistakes
Avoid treating a supplier demonstration as complete preparation, assuming seniority establishes every specialist capability, or evaluating training only through satisfaction scores. A positive learner reaction is useful feedback but does not demonstrate application. Contractors doing work under organisational control also need appropriate consideration; an external employment relationship does not remove the task's effect on performance.
Frequently asked questions
Does every AI role require a formal qualification?
No. Appropriate education, training or experience can establish competence. The evidence should fit the actual responsibility and conditions.
Can a course certificate prove competence?
It can contribute evidence of learning or completion. The organisation still needs to establish whether the person can perform the task effectively.
How do we assess highly specialised work?
Use suitable expertise and evidence for the responsibility. Do not have an unqualified reviewer make unsupported technical conclusions merely to complete a form.
Match learning to one important AI responsibility
Ask Sterling to help define an AI competence and evidence plan. Agreed support can include role-based implementation and Effivity ISO & GRC automation software. AI Risk & Impact Assessment is a relevant learning route for assessment contributors, followed by application of your own method. See clause 7 and the complete library.