ISO/IEC 42001
Clause 5.3 — Roles, responsibilities and authorities
Clause 5.3 is where an AI management system acquires owners. Top management has to assign and communicate responsibilities and authorities for the roles the system depends on, and two of those assignments are named in the clause itself: answering for conformity with the standard, and reporting how the system is performing back to top management.
§ 1 — Who it binds
Whose duty this is
Audited organisation
Any organisation operating an AI management system to ISO/IEC 42001. The duty is top management’s, and it is not discharged by writing an allocation into a manual: assignment and communication are separate acts and both have to have happened. It applies whether the AI systems in scope were built in house or bought, since the responsibilities allocated inside the organisation do not shrink because the model belongs to a supplier.
§ 2 — In practice
The two accountabilities
The clause is usually read as an instruction to draw a responsibility matrix, and the drawing is not the hard part. The hard part is that an organisation running AI systems has two distinct accountabilities to place and normally places only one. The first is for what a given system does — its outputs, its errors, the decisions taken on its recommendations — and that assignment tends to exist already, because somebody owns the product. The second is for the management system: whether it conforms, whether it is maintained, whether the policy adopted under clause 5.2 is applied. The second is what clause 5.3 is about, and where it is unassigned nobody notices until an audit asks who answers for conformity.
A second conflation is specific to this standard. Clause 4.1 requires the organisation to determine its own role or roles in relation to AI systems — a statement about what the organisation is, and it may be several things at once. Clause 5.3 concerns roles inside the organisation: people, holding responsibilities and authorities, told that they hold them. A register answering the first and filed against the second is common, and it produces a document naming the organisation as developer and user of four systems with no individual named anywhere on it. The two answer different clauses, and an assessor asks for both.
The reporting limb is the one most often satisfied by accident. Responsibility for reporting on the performance of the management system to top management is an assignment in its own right, which means somebody holds it, knows they hold it, and can point to what they reported and when. Where that reporting happens inside a quarterly product review with no separate record, the duty has been performed and cannot be shown. Authority is the other half people drop: responsibility without authority produces a role holder who can be blamed and cannot act, and the practical test is whether the named person can stop a release. Where the system is supplied by a third party, the allocation has to reach across the contract too — the arrangement Article 26 leans on when it puts duties on a deployer that only a named individual can discharge.
§ 3 — What a weak answer looks like
An organogram is not an assignment
An organogram offered as an assignment. It is accurate, it is current, and it answers a different question: who somebody works for, rather than what they answer for and what they may decide. Nothing on it names conformity with the standard, nothing names whoever reports performance upward, and no box carries an authority — so the one thing the clause exists to establish, that a named person is able to act, is exactly what cannot be read off it. It is usually produced within a minute of the request, which is what makes it convincing.
§ 4 — What discharges it
What the assignment record must show
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
A role assignment register naming individuals rather than forums
Each AIMS role, the person holding it, and the authority attaching to it. Where a row names a committee, an assessor asks which member answers for it, and the register should have settled that in advance rather than at interview.
02
The conformity assignment, stated discretely
Answering for the management system’s conformity to the standard should appear as one line held by one person, not spread across owners of individual systems who each answer only for their own.
03
Reports of AIMS performance to top management, with dates
What was reported, by whom, to whom, and when. An agreed frequency that slipped is a smaller problem than a duty discharged inside somebody else’s meeting and never written down anywhere.
04
Evidence that each assignment was communicated to its holder
Acknowledgement by the named person, dated. Assigning and communicating are separate limbs, and the failure mode is a manual allocating a duty to somebody who first learns of it when they are asked about it.
§ 5 — Worked example
Worked example — a committee accountable for everything
An insurer’s AIMS covers six models. The responsibility matrix in the manual reads: AI Governance Committee — accountable for the AI management system; model owners — responsible for model performance; data science lead — responsible for AI risk assessment; chief risk officer — consulted. The committee has eight members, meets monthly, minutes its decisions by consensus, and reports into the risk committee twice a year.
Everything in the manual is assigned. What is not?
Conformity and the reporting line — the two limbs the clause names. A committee can be given a remit, but responsibilities and authorities attach to people who can exercise them, and eight members accountable by consensus is nobody accountable: an assessor asking who answers for conformity is handed a diary invitation. The reporting limb is worse placed than it looks, because reporting into the risk committee is not reporting to top management, and twice a year is a frequency nobody set against anything. Two changes cover most of it and neither needs a reorganisation. Name an individual — a role held by a person, not a forum — as answering for the conformity of the management system, with the authority to hold a release. Then name whoever reports its performance to top management, state the interval, and keep the report as a document rather than as an agenda item. The model owners’ line is sound and is doing a different job; leave it alone.
§ 6 — Elsewhere
Where the duties land outside
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Article 26 places duties on the deployer of a high-risk system that only a person inside the organisation can perform, among them assigning human oversight to someone with the competence, training and authority to exercise it.
Auditing a management system calls for competence criteria set for that work. Where one person holds an AIMS role and also audits it, the assignment register is where the conflict becomes visible.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7 — When it applies
Which edition this is
31 December 2023
The date BSI published its adoption of the first edition, BS ISO/IEC 42001:2023. It marks the edition rather than any deadline — the standard is voluntary and no obligation falls due on this date.
31 March 2026
Publication of BS EN ISO/IEC 42001:2026, the European and UK adoption, which BSI records as carrying no technical differences from the 2023 adoption. An edition date, not a compliance date.
§ 8 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
- Official contents page of ISO/IEC 42001:2023 — clause 5.3 Roles, responsibilities and authorities, within clause 5 Leadership.
- BSI Knowledge record for BS ISO/IEC 42001:2023 — published 31 December 2023, committee ART/1, status Current.
- BSI Knowledge record for BS EN ISO/IEC 42001:2026 — published 31 March 2026, status Current, no technical differences stated.
- The NIST-hosted crosswalk maps the AI RMF GOVERN 2.1 subcategory onto clause 5.3. Attributed to Microsoft on the AIRC crosswalks index; a contributed document, not NIST guidance.
§ 9 — Also read
Also read
Understanding the organisation and its context — clause 4.1
What is AI assurance? A practitioner’s definition
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.