ISO 42001 Clause 7.4: Plan AI Communications That Reach the Right People

What clause 7.4 requires in practice

Clause 7.4 requires the organisation to decide which internal and external communications bear on the AI management system. For each, it settles four questions: what will be communicated, when, with whom and how. The clause covers both directions and both audiences, so it reaches employees, customers, suppliers, regulators and other interested parties as appropriate.

It does not create a universal incident-notification deadline, a prescribed communication matrix or a duty to publish everything. Specific external obligations, for example from law or contracts, must be identified separately and may add their own timing or content rules. The Annex A theme on information for interested parties offers related controls, which the organisation selects through risk treatment. The test of the requirement is practical: do the right people receive the right information in time, in a form they can act on, so the management system can respond when something changes or goes wrong.

Connect communication with a decision

As a suggested method, identify a situation that changes what someone may do: an approved use changes, a limitation is discovered or management accepts treatment with conditions. Determine who needs the information, when it matters and how it reaches them. Different audiences may need different detail.

A technical supplier notice may need translation into an operating instruction for users. A performance report for management may need to identify the decision required. Avoid forwarding raw information and assuming every recipient can infer its significance.

Why communication planning matters to the business

Governance decisions only work if they reach those who must apply them. A supplier notice that sits in a procurement folder, a revised operating limit that reaches the day shift but not temporary staff, or a concern raised at night with no one assigned to respond are all communication failures that become operational ones. Planning communications reduces delay, avoids inconsistent messages to customers and clarifies who may speak for the organisation externally. It also helps global teams, where local language, working hours and obligations differ. The investment is small compared with the damage caused when a known limitation never reaches the people relying on the output.

How to implement clause 7.4

Link each communication to a decision or action, and test the route in realistic conditions.

1. Identify situations that change what someone may do, such as a change in approved use, a discovered limitation, a supplier notice or management acceptance of a conditional treatment.
2. For each, decide who needs to know, what they need to know and by when it matters.
3. Choose methods that people can actually use, considering language, access, sensitivity and urgency.
4. Decide who may communicate externally and how content is reviewed, coordinating with specialists where legal or contractual rules apply.
5. Assign responsibility for monitoring each route, including cover outside headquarters hours and during planned absences of the usual recipient.
6. Test one ordinary message and one difficult exception, checking that recipients understood the required action.
7. Update the arrangements when roles, services or supplier dependencies change.
8. Keep a short list of current contacts and deputies so a message never depends on one person being present.

Illustrative IT example: a notice arrives outside headquarters hours

Illustrative manufacturing example: a revised operating limit

A manufacturer restricts an AI inspection aid to specified product variants after evaluation identifies a limitation. The revised instruction reaches the day-shift supervisor but not temporary workers assigned to another shift. The control decision exists, yet the people applying it lack the information.

The organisation clarifies the affected audience and communication method, including how supervisors confirm understanding before work. A broadcast to office email accounts would not solve the access problem. The response follows the work rather than the convenience of the communication team.

Distinguish communication needs and authority

Internal escalation, customer guidance, incident communication and wider interested-party information can have different purposes. Determine who is authorised to communicate externally and how information is reviewed where needed. Coordinate with specialists when legal, contractual or sector obligations affect content or timing.

Clause 7.4 does not create a universal incident-reporting deadline or require every concern to be publicly announced. The Annex A information theme develops related controls for users and interested parties, selected through the treatment process. Specific external obligations still need appropriate determination.

Choose methods people can use

Consider accessibility, language, sensitivity and urgency. A detailed procedure can support routine work; an urgent restriction may need a different route. Sensitive assessment results should reach authorised recipients without unnecessary disclosure. Availability and protection need to work together.

An optional communication plan can make arrangements visible, but no universal matrix is prescribed. Keep the plan connected with real contacts and responsibilities. A role change, new customer service or supplier dependency may require the route to be updated.

Evidence and failure tests