04.6 Human resources

As part of resource identification, the organisation shall document information about the human resources and their competences utilised for the development, deployment, operation, change management, maintenance, transfer and decommissioning, This control is essential for maintaining governance and ensuring that AI systems are managed responsibly. It should be applied consistently across all relevant organisational processes and reviewed periodically to remain effective.

Business Requirement The purpose of this control is to safeguard organisational integrity, compliance with legal and regulatory requirements, and to promote trustworthiness in AI systems. It ensures that risks are mitigated and that the organisation’s objectives for responsible AI use are achieved.

The organisation should consider the need for diverse expertise and include the types of roles necessary for the system. For example, the organisation can include specific demographic groups related to data sets used to train machine learning models, if their inclusion is a necessary component of the system design. Necessary human resources can include but are not limited to: — data scientists; — roles related to human oversight of AI systems; — experts on trustworthiness topics such as safety, security and privacy; — AI researchers and specialists, and domain experts relevant to the AI systems. Different resources can be necessary at different stages of the AI system life cycle. Organisations should implement this control by establishing clear procedures, assigning responsibilities, and maintaining accurate documentation. Practical steps include integrating this control into existing governance frameworks, training relevant personnel, and monitoring compliance through regular audits.