ISO/IEC 42001:2023 A.8.3: External reporting

What else in your programme already covers this

This control maps to 18 controls across 11 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

EU AI Act · 3 controls

EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems
EUAI-Art.73 Reporting of serious incidents
EUAI-Art.87 Reporting of infringements and protection of reporting persons

NIST AI Risk Management Framework (AI RMF 1.0) · 3 controls

AIRMF-GV-5.1 Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks
AIRMF-GV-5.2 Mechanisms are established to enable AI actors to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation
AIRMF-MS-3.3 Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics

ISO 27001:2022 · 2 controls

5.24 Information security incident management planning and preparation
5.5 Contact with authorities

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-RS.CO-02 Internal and external stakeholders are notified of incidents
NIST-CSF-RS.MA-02 Incident reports are triaged and validated

SOC 2 · 2 controls

SOC2-CC2.3 CC2.3 Communication with external parties about internal control (COSO principle 15)
SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures

APPI · 1 control

APPI-A40 Processing of Complaints

Australia National Framework for the Assurance of AI in Government (2024) · 1 control

7.2 7.2 Communicate rights and protections clearly

EASA Part-IS - Information Security in Aviation · 1 control

IS.I.OR.225 External Reporting

NIST SP 800-218 · 1 control

SP800-218-RV.1.3 Vulnerability Disclosure Policy

NIST SP 800-53 Rev 5 · 1 control

NIST800-PM-26 PM-26 Complaint Management

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 A.8.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gaps If you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 each Browse the graph free