A.10.2 Explainability of AI Systems — ISO 42001 Control Guide

What this means

Your organization must establish and maintain measures that make AI system outputs understandable to relevant stakeholders. This control requires you to explain the basis for AI decisions and recommendations in ways appropriate to the context and risk level. The goal is enabling accountability, supporting oversight, and building justified trust in your AI systems. Explainability doesn't mean making every technical detail visible; it means providing sufficient transparency for stakeholders to understand *why* the AI made that choice.

How to comply

1. 1.Map all AI systems in use and assess their risk levels (high-risk systems require deeper explainability)
2. 2.Define explainability requirements for each stakeholder group (executives, end-users, auditors, regulators)
3. 3.Document the decision logic, data inputs, and model behavior for each AI system in plain language
4. 4.Implement technical tools (feature importance reports, decision trees, confidence scores) to support transparency
5. 5.Create explainability guides or dashboards that stakeholders can access proportional to their role
6. 6.Test explainability measures with actual stakeholders to ensure comprehension
7. 7.Review and update explainability documentation when AI models or training data change
8. 8.Train staff on how to interpret and communicate AI system outputs to non-technical audiences

Evidence auditors look for

• AI explainability policy documenting risk-based transparency requirements
• System-level documentation showing inputs, logic, and output reasoning for each AI application
• Stakeholder-specific guidance (e.g., executive summaries, technical whitepapers, user FAQs)
• Feature importance reports or model card documentation showing what factors drive AI decisions
• Audit logs showing who accessed explainability information and when
• Training records confirming staff understand how to explain AI outputs
• Evidence of stakeholder feedback on explainability clarity and updates made in response
• Change logs tracking updates to AI models and corresponding explainability measure revisions

Frequently asked questions

GRCWatch automates the documentation and stakeholder mapping for A.10.2, letting you generate explainability requirement matrices by risk level and role—then track updates to AI systems against your explainability obligations in one dashboard.

See how GRCWatch handles this control automatically

Related controls