This step first proposes Annex A and B control measures for each significant risk in Steps 5 and 6 (matched to the chosen scope and to development, supply and use), and when your company chooses to apply or exclude each control in the control selection table, the Statement of Applicability is prepared on the basis of that selection.
Controls (management measures) that reduce risk are chosen, and the reasons for the controls used and not used are written in the Statement of Applicability (SoA), because you must be able to explain which controls are used and why. You receive the Statement of Applicability, the human oversight design table and the list of compliance obligations.
The Step 5 risk assessment results (grounds controls of the treatment plan and comparison with the Statement of Applicability) are used as input. The Annex A controls chosen in risk treatment are justified in the Statement of Applicability (SoA), and human oversight (review, intervention, override authority), legal requirements and compliance obligations, and resources and competence for AI systems are designed. The draft Statement of Applicability of Step 4, the grounds controls of the Step 5 treatment plan and the Step 6 impact assessment mitigation measures are combined to finalize all 38 controls (Rev.1.0, approved by top management), and Steps 8 to 16 continue to record the implementation status and evidence on this finalized version.
With the chosen controls, the risk after controls is reassessed to confirm effectiveness, human oversight, legal requirements, compliance obligations and resources and competence for AI systems are designed, and then the Statement of Applicability, the grounds controls of the treatment plan and the mitigation measures are combined into one approved version approved by top management.
Output
- Statement of Applicability (SoA)For each Annex A area (A.2 to A.10): reason for application or exclusion / implementation method / related documents and records
- Human oversight design tableOversight method / person with override authority / point of intervention / route for reporting concerns
- List of legal requirements and compliance obligations, plan for resources and competence (awareness training targets)
- Finalized Statement of Applicability (Rev.1.0): applicability, grounds, implementation method, implementation status and evidence for all 38 controls, changes from the draft, approval and revision history (Excel)
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| Focus on A.6 lifecycle, A.7 data controls and responsible design and development objectives | Focus on A.8 information for interested parties, A.10 customer relations and allocation of responsibilities controls | Focus on A.9 responsible use, A.10.3 supplier controls and use guidelines (prohibited input information, etc.) |
Next steps
Previous steps: 5 AI Risk Assessment · 6 AI System Impact Assessment · 1 AI Context Analysis · 2 AI Policy, Roles and Objectives · 15 Nonconformity and Corrective Action · 14 Management Review · 16 Improvement · 10 Documented Information Control · The output of this step is carried forward in: 8 Verification and Use Approval · 9 Operational Control · 10 Documented Information Control · 11 Monitoring, Change and Revision Control · 12 Internal Audit · 13 Legal Requirements Identification and Monitoring · 15 Nonconformity and Corrective Action
