ISO 42001 AI System Description

Overview

Draft AI system description and intended purpose per system for ISO/IEC 42001:2023.

Getting Started

Add your source materials to the project workspace, then activate the ISO 42001 AI System Description skill. The agent will guide you through the process step by step.

Example conversation

You: We need a clear system description and intended purpose for our recommendation engine for the auditor and for our SoA.

Agent: I’ll draft the system description using the skill reference. I’ll describe what the system does, its intended purpose and impact, how it interacts with our product and users, key capabilities and limitations, and a high-level view of data inputs and outputs. I’ll run system_description_check on the draft and fix any missing elements, then link it to the risk register, impact assessment, and monitoring plan.

Output excerpt

System description excerpt

System — Recommendation engine (v2). Component of [Product name] used to rank and select content for logged-in users.

Intended purpose — Improve relevance and engagement by personalizing content based on user behaviour and contextual signals. Intended impact: better user experience and retention; no direct legal or safety-critical decision.

Interaction — Consumes events from [e.g. analytics pipeline]; outputs rankings to [e.g. content API]. Used by [e.g. web and app]. No interaction with other AI systems. Human oversight: product and content team review metrics and feedback.

Capabilities and limitations — Capabilities: real-time ranking; A/B testable; explainability via [e.g. feature contribution]. Limitations: cold-start for new users; not used for eligibility or credit. Known risks: bias, drift; mitigated per risk register and monitoring.

Data — Inputs: [e.g. event stream, user segment]. Outputs: scores and ranking. No special-category data in model input. See data governance and impact assessment.

Extension and validation

The skill includes system_description_check, which validates the AI system description for required elements: system description (what it does, components, interfaces); intended purpose and impact; interaction with operations, users, and other systems; capabilities and limitations; data inputs and outputs. Run it after drafting and address any missing elements.