ISO 42001 Clause 7.3: Make AI Awareness Useful in Daily Work

What clause 7.3 requires in practice

Clause 7.3 requires that people doing work under the organisation's control are aware of three things. The first is the AI policy. The second is what they personally add to making the AI management system effective, including the benefits of better AI performance. The third is what follows if they do not conform to the system's requirements.

Awareness is not the same as competence. It means understanding the direction, one's part in it and the consequences of departing from it. It applies to everyone whose work falls under organisational control, including contractors. The clause does not prescribe a course, duration, attendance record or annual cycle. Briefings, scenarios, supervision conversations and other methods can all contribute, provided the three awareness points are genuinely understood. Because policy, approved uses and operating conditions change, awareness needs refreshing when they do; last year's examples may not cover this year's tool features or customer situations.

Start with decisions employees encounter

As an original design approach, select a small number of situations from actual work. An employee may be asked to upload unfamiliar information, use a tool for a new purpose or trust a plausible answer without enough evidence. Explain how the policy and approved process apply, including where help is available.

Keep awareness distinct from specialist competence. A person may need to recognise that a new use requires assessment without being qualified to conduct that assessment. Expecting every employee to become an AI risk specialist can make the message harder to use.

Why awareness matters to the business

Many AI incidents begin with an ordinary person doing something reasonable: uploading unfamiliar information, trusting a fluent answer or using an approved tool for a new purpose. Awareness that helps staff recognise those moments is cheap compared with the cost of correcting them later. It also encourages early reporting, because people who understand how they contribute are more likely to speak up when something looks wrong. A balanced message matters: alarmist training can push AI use out of sight, while vague enthusiasm leaves staff unsure of boundaries. Clear, role-relevant awareness gives the business a workforce that applies controls willingly and notices when they do not fit.

How to implement clause 7.3

Build awareness around decisions employees actually face, and check understanding through conversation, not only attendance.

1. Collect a handful of real situations from daily work where AI output is trusted, shared or extended to a new purpose.
2. Explain for each how the AI policy and approved process apply and where to find help.
3. Make the contribution of each role visible, for example noticing and reporting an omission in a generated summary.
4. State plainly the implications of not following the requirements, without overstating them.
5. Adapt the message to developers, procurement, managers and front-line users, and to language and working patterns.
6. Check understanding with short scenarios and by observing choices, including whether people use the escalation route.
7. Refresh the material when policy, approved uses or tools change, and when audits or concerns show a recurring misunderstanding.
8. Invite employees to submit examples of confusing situations, and use the best of them in future briefings.

Evidence an auditor expects for clause 7.3

The auditor's main question is whether people can explain the policy and their part in it.

• Interviews in which staff describe the AI policy in their own words and give an example of what it means for their job.
• Briefing material, onboarding content or team discussions that show how awareness is built.
• Observations of how employees handle a realistic scenario, including escalation.
• Records of refreshed messages after a change in policy or approved uses.
• Evidence that contractors working under organisational control receive the same foundation.

Attendance lists support but do not prove understanding.

Illustrative BPO example: a convincing reply outside the approved scope

Illustrative construction example: a summary omits a qualification

A construction project team uses AI to summarise correspondence. An engineer notices that a draft summary omits a condition attached to an instruction. The awareness programme explains why checking consequential statements matters and how corrected information should reach colleagues who received the summary.

The example connects improved AI performance with a real contribution: identifying and reporting a limitation that can inform better use. It also explains implications of bypassing the process, such as decisions based on incomplete information, without claiming that every mistake automatically becomes a legal breach or management-system nonconformity.

Adapt the message to the role and setting

Procurement, developers, managers and front-line users encounter different decisions. They need a common policy foundation and relevant examples. Contractors under organisational control may also need awareness. Consider language, working hours and access so the message reaches the people expected to apply it.

Communication should make reporting a concern practical. Staff who are told to escalate but cannot identify a usable route may remain silent. Connect awareness with reporting concerns and communication arrangements.

Check understanding and refresh relevant changes

Clause 7.3 does not prescribe an annual course, fixed duration or particular attendance record. Briefings, guided examples and other suitable methods can contribute. Evidence of delivery may be useful, but conversations and observed choices can show whether the message is understood.

Refresh awareness when policy, approved uses or operating conditions change. A new tool feature may create a situation that last year's examples never addressed. Use feedback from errors, concerns and audits to improve the material rather than repeatedly presenting identical slides.

Common mistakes