Roles and responsibilities under ISO 42001
ISO 42001 requires documented roles and responsibilities for AI management. This piece defines the roles the standard expects, how they map to typical organisational structures, and what each role must be able to demonstrate.
ISO 42001 requires documented roles and responsibilities for AI management. This is not a soft requirement. The standard explicitly states that top management must assign responsibility and authority for the AI management system, and the assignment must be documented. At audit, the question is not whether roles are named in a job description — it is whether the roles are exercising the authorities the standard requires, and whether the records prove it.
Most organisations that struggle with ISO 42001 role requirements have named the roles without assigning the authorities. The role exists on paper; the person in the role has not been told what decisions they can make, what they are accountable for, or what the evidence of that accountability looks like. This piece defines what the standard requires and how to close the gap.
Why roles matter in a management system
Management system standards are built around accountability. A policy without an owner is a statement of intent. A risk register without a named acceptor is a list. A management review without a named decision maker is a meeting. ISO 42001 requires the role structure that converts each of these documents into accountable actions.
What ISO 42001 explicitly requires
ISO 42001 Clause 5.3 states that top management shall ensure that responsibilities and authorities for relevant roles are assigned, communicated, and understood. The clause identifies two specific requirements:
- Responsibility must be assigned for ensuring that the AIMS conforms to the requirements of the standard.
- Responsibility must be assigned for reporting on the performance of the AIMS to top management.
These two requirements define the minimum role structure: a person or function that owns the AIMS (responsible for conformance) and a reporting line to the executive level (responsible for performance reporting). Everything else — system owners, risk acceptors, auditors — flows from these two anchors.
Top management obligations
ISO 42001 Clause 5 places several obligations directly on top management — obligations that cannot be delegated. Top management must:
- Establish, implement, maintain, and continually improve the AIMS.
- Communicate the importance of effective AI governance and conformance with AIMS requirements.
- Ensure that AIMS objectives are compatible with the organisation's strategic direction.
- Ensure that the resources required for the AIMS are available.
- Demonstrate leadership and commitment with respect to the AIMS.
The “demonstration” requirement is what creates the evidence obligation. Top management demonstrating commitment means making AI governance a visible agenda item at executive level — in board minutes, in management review records, in resource allocation decisions. A CEO statement on a website does not satisfy this clause; an executive committee meeting that reviewed AIMS performance and made resource decisions does.
The most common gap in the leadership clause is organisations that have named an AI governance lead but have not created the executive reporting line. The AI governance lead produces excellent documentation that nobody at executive level has reviewed. That is a Clause 5 gap, and it is a major nonconformity at audit.
The AI governance function
The AI governance function is the role or team that operates the AIMS on a day-to-day basis. Organisations variously call this role AI Ethics Officer, AI Governance Lead, Head of Responsible AI, or AI Risk Manager. The title is not specified by the standard; the authorities and accountabilities are.
The AI governance function must have defined authority to:
- Require AI system owners to produce and maintain risk register entries, treatment plans, and operational procedure records.
- Require AI system owners to complete re-assessments when trigger criteria are met.
- Escalate AIMS non-conformances to the executive level with a recommendation for resolution.
- Convene and manage the management review cycle, including producing the agenda and recording decisions.
The evidence that this authority is real — not just documented — includes instances where the AI governance function exercised it: a risk re-assessment initiated because the governance lead triggered it, an escalation record, a management review minute showing that the governance function's report was presented and discussed.
Operational roles
Below the AI governance function, ISO 42001 requires operational role assignments for each AI system in scope:
ISO 42001 required roles — authority, accountability, and evidence
| Role | Authority | Accountable for | Evidence |
|---|---|---|---|
| Executive sponsor / top management | Approve AI policy, assign AIMS ownership, provide resources | AIMS overall — that it exists and is resourced | Board minutes, policy sign-off record, appointment documentation |
| AI governance lead | Maintain AIMS, oversee risk management process, manage audit cycle | AIMS operation — that processes run and records are maintained | Role charter, risk register ownership, management review records |
| AI system owner | Approve risk assessment for assigned system, accept residual risk within threshold | System-level risk register entry, treatment plan, operational procedure compliance | Named in risk register, signed treatment plan, change notification records |
| Risk acceptor | Accept residual risk above threshold on behalf of the organisation | Named acceptance decisions in risk register | Signed risk acceptance records with date, conditions, and re-review trigger |
| Internal auditor | Audit AIMS clauses against the standard | Audit programme completion, finding reporting | Audit reports, independence confirmation, competency record |
AI system owners are the most operationally critical role. They are the people who know the systems, who commission the risk assessments, and who accept the residual risks. An auditor will ask them, directly, to describe the risks associated with their system and to produce the treatment plan. A system owner who cannot do this is evidence of a role in name only — which is a nonconformity.
Relationship to the DPO
Organisations subject to GDPR will already have a Data Protection Officer. The DPO role and the ISO 42001 AI governance roles overlap in scope but are not identical. Key distinctions:
The DPO is responsible for data protection compliance — ensuring that personal data is processed lawfully. The AI governance lead is responsible for AI management system conformance — ensuring that the AIMS operates and produces defensible records. For AI systems that process personal data (most enterprise AI), the two roles must coordinate on DPIAs, data subject rights, and incident notification.
ISO 42001 Annex A.6.2 (AI impact assessment) and GDPR Article 35 (DPIA) overlap for AI systems that make or influence decisions about individuals. The most efficient approach is a combined AI impact assessment and DPIA process, with the DPO and AI governance lead jointly responsible for the output.
The DPO cannot be directed to perform tasks that conflict with the independence requirement under GDPR Article 38. Assigning the DPO as the AI governance lead is permissible if there is no conflict of interest — but requires careful scoping to avoid creating a situation where the DPO is reviewing decisions they made in their operational capacity.
Documentation requirements
ISO 42001 Clause 5.3 requires that responsibilities and authorities are communicated. Communication means the people in the roles know they are in them — and know what the roles require. Evidence of communication includes:
- A role charter or terms of reference for the AI governance function, signed by the executive sponsor.
- Named AI system owner assignments in the AIMS scope document or risk register, with acknowledgement records.
- Risk acceptor authority levels documented in the risk management process, with delegation records where authority has been delegated below the executive level.
- Internal auditor competency records and independence declarations.
Job descriptions alone are not sufficient. An auditor may ask to see the job description — but they will also ask to see evidence that the role was actually exercised. A risk register entry signed by the named system owner is evidence of exercise. A job description that mentions AI governance is evidence of intent.
The ISO 42001 AI governance toolkit includes a role charter template, an AI system owner assignment record, and a risk acceptor authority matrix that cover the documentation requirements for each role.
Blog
Get new posts in your inbox
AI security review, OWASP Agentic Top 10, ISO 42001 evidence, and what AI Committees actually need. No cadence promises — we publish when there's something worth reading.
Structure your AI governance roles around auditable evidence
Drel produces the system-level risk and control evidence that AI system owners need to fulfil their ISO 42001 accountabilities for assessed systems.
A note on scope: Drel reviews assessed systems against documented architecture, configuration and intent. It does not ingest live telemetry from production environments. Dispositions reflect the assessed system at the time of review and the re-assessment triggers that govern when the disposition must be revisited.