ISO 42001 Clause 7: Support People and Reliable AI Decisions

What clause 7 requires in practice

Clause 7 covers the support the management system needs to function. Clause 7.1 requires the organisation to determine and provide the resources needed to establish, implement, maintain and continually improve the system. Clause 7.2 requires it to determine the competence needed by people whose work affects AI performance, ensure they are competent through education, training or experience, act where competence is lacking and keep evidence. Clause 7.3 requires those people to be aware of the AI policy, of how they contribute to effectiveness and of what follows from not conforming.

Clause 7.4 requires the organisation to decide what to communicate, when, to whom and how, internally and externally. Clause 7.5 deals with documented information: what the system must include, how information is created and updated, and how it is controlled for availability, protection, change, storage and retention. Together these clauses ask whether people have what they need to make reliable AI decisions in daily work.

7.1: provide resources that match the work

The organisation determines and provides resources needed to establish, implement, maintain and continually improve the AIMS. Consider the actual tasks: assessing a use, understanding supplier information, reviewing outputs, investigating concerns and maintaining records. Assigning responsibilities without allowing time or access to expertise can undermine the system.

In a hypothetical BPO business, staff must check AI-drafted replies before sending them. If the service target leaves no realistic time for review, a policy requiring careful checking does not solve the resource conflict. Management should understand the workload and the purpose of the review before concluding that the control is operational.

7.2: demonstrate competence for each responsibility

The organisation determines necessary competence for people working under its control whose work affects AI performance. It ensures appropriate capability through education, training or experience and, where applicable, takes development action and evaluates its effectiveness. Suitable documented information provides evidence of competence.

The BPO employee reviewing a reply needs to recognise unsupported claims and know when to seek help. The person evaluating the AI service needs different technical and assessment capability. A course completion record may contribute evidence, but it does not automatically demonstrate either person's ability to perform their particular task.

Suggested development can combine learning with supervised application and examination of completed work. Choose evidence that reflects the responsibility. Avoid expecting general awareness training to qualify someone to assess a complex model or interpret specialised legal requirements.

7.3: make awareness relevant to real choices

People working under organisational control need awareness of the AI policy, their contribution to AIMS effectiveness and improved AI performance, and implications of not conforming to system requirements. Awareness should help someone recognise the decision they face, not merely recall a definition.

For a hypothetical construction consultancy, employees use an AI tool to summarise design correspondence. Awareness includes recognising that a generated summary may omit an important qualification and that the approved process still governs professional decisions. A short scenario about a disputed instruction may teach more than a generic presentation about the history of AI.

7.4: establish usable communication routes

The organisation determines relevant internal and external communication: what is communicated, when, to whom and how. This can involve changes in approved use, concerns, supplier information and performance results. Clause 7.4 does not create a single universal incident-notification deadline across jurisdictions.

As a practical check, follow a concern raised outside headquarters hours. Can the employee identify the right route, describe the relevant use and obtain an authorised decision? A mailbox that nobody monitors during critical operations may not support the intended process, regardless of whether its address appears in a policy.

7.5: control information through its lifecycle

Clause 7.5.1 includes documented information required by the standard and information the organisation needs for AIMS effectiveness. Clause 7.5.2 addresses suitable identification, format, media, review and approval when information is created or updated. Clause 7.5.3 addresses availability and protection, including access, retrieval, storage, readability, changes, retention and disposal. Relevant externally sourced information also needs appropriate control.

In the construction example, a supplier revises the tool's operating limitations. Someone needs to evaluate whether the internal instruction remains suitable and ensure affected employees can identify the current version. Keeping the supplier notice in an unread folder is different from controlling its effect on the process.

Protect sensitive assessment and investigation records while allowing authorised people to use them. Retention decisions should reflect applicable requirements and organisational needs; the clause does not prescribe one number of years for every record.

Why support arrangements matter to the business

Most AI control failures are support failures. A review step exists but nobody has time to perform it, an instruction exists but is not where the work happens, or a supplier notice arrives with nobody competent to read it. Investing in resources, competence, awareness, communication and information control makes controls operable. It also cuts the cost of audits and client reviews, because evidence is findable and staff can explain what they do. For leaders, this clause is the practical test of whether governance is real: if a policy cannot be applied by an ordinary employee on an ordinary day, the policy is not yet doing its job.

How to implement clause 7

Work from the tasks people must perform, rather than from the list of sub-headings. A sensible approach is to follow one control from design to daily use and check what supports it.

1. Choose a control, such as review of AI output before customer use, and list the tasks, skills, information and time it needs.
2. Compare that list with current staffing and capacity, and decide how gaps will be closed or the permitted use restricted.
3. Define the competence each role needs and choose evidence that reflects the task, not just course attendance.
4. Build awareness around realistic situations employees face, and keep it distinct from specialist competence.
5. Map the communications that must reach people when approved uses change or limitations appear, including out-of-hours routes.
6. Check that the instructions, records and supplier information that support the control are current, findable and protected.
7. Review the support arrangements when scope, suppliers or locations change, and when staff report that a control cannot be performed as designed.

Evidence and support mistakes

Explore each numbered part

Illustrative example: supporting AI review in a laboratory

A hypothetical testing laboratory in Australia uses AI to draft summaries of test results for client reports. Its control requires a qualified scientist to check each summary before release. When the laboratory expands into a new service line, volumes rise and the single reviewer cannot keep up. Management examines resources and decides to add a second trained reviewer and to restrict the AI-drafted summaries to routine reports until capacity improves. It also finds that new technicians know the policy exists but cannot recognise a summary that misstates a limit of detection. A scenario-based briefing is added, supplier notices are routed to the quality manager, and the current instruction is moved to the workstation where reports are prepared.