This step discusses each nonconformity with the AI to find its cause and decide the corrective action, so that the same problem does not recur. You receive the nonconformity and corrective action register, the cause analysis, and the effectiveness review results.
Based solely on ISO/IEC 42001, each nonconformity is discussed with the AI. In the "Nonconformity and corrective action consultation" window under Run this step, you confirm G1 clause (main clauses, and Annex A controls in the SoA) → G2 nonconformity description and grade → G3 root cause → G4 improvement measure (step to redo) → G5 schedule and person in charge.
The confirmed content becomes the Excel nonconformity and corrective action register (31 columns, with formulas). It takes in the findings of 12 Internal Audit (nonconformities and observations), the nonconformities and non-compliance from 13 Legal Requirements Identification and Monitoring, and AI incidents, and corrects the nonconformities. After establishing corrective actions that find the root cause and prevent recurrence, the effectiveness is reviewed and the risk assessment, impact assessment, Statement of Applicability and guidelines are updated.
Internal audit results are imported automatically in this browser. Cases passed on from the Step 11 incident register (S1·S2, recurrence, violation of approval compliance, ineffective control, violation of legal or contractual requirements) are also judged for nonconformity, and the root cause and corrective action are determined.
Output
- Nonconformity and corrective action registerSource (internal audit, legal compliance check, incident) / clause and control / description / immediate action (correction)
- Cause analysis and corrective action planCauses found by 5 Whys (asking why repeatedly): insufficient data, algorithm, use or controls. Corrective action plan, person in charge, deadline and completion criteria
- Effectiveness review, the list of updates to the risk assessment, impact assessment, Statement of Applicability and guidelines, and input to the next management review
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| Root causes of model and data defects, retraining and re-verification, and correction of development procedures | Customer notification of nonconformities affecting customers, terms of provision, and correction of user documentation | Causes of incorrect use or output, and correction of usage guidelines, scope of use and training |
Next steps
Previous steps: 12 Internal Audit · 11 Monitoring, Change and Revision Control · 13 Legal Requirements Identification and Monitoring · 14 Management Review · 5 AI Risk Assessment · 7 Control Implementation and Statement of Applicability (SoA) · 10 Documented Information Control · The results of this step feed into: 2 AI Policy, Roles and Objectives · 5 AI Risk Assessment · 7 Control Implementation and Statement of Applicability (SoA) · 12 Internal Audit · 14 Management Review · 16 Improvement
