AI System Requirements Register
ISO 42001 Annex A.4.5 — capture, version, and sign off the requirements and specifications for each AI system before it goes to production.
What it is
The Register at /governance/system-requirements stores per-system requirements covering functional behaviour, intended and prohibited use, performance targets, data quality, safety, security, transparency, human oversight, and applicable regulation.
Every requirement records its acceptance criteria, target value, measurement method, MoSCoW priority, and current status — so an auditor can see, for any AI system, which requirements were defined, which were met, and who signed off.
Who can use it
- All org members: view their org's requirements.
- WorkflowAdmin and OrgAdmin: create, edit, and sign off requirements.
- OrgAdmin: delete requirements.
- Super Admins: read and manage all requirements (impersonation/support).
Tenant isolation is enforced through Row Level Security on ai_system_requirements via get_user_org_id(auth.uid()).
Statuses & priorities
Versioning & sign-off
Each requirement carries a version integer. The database trigger automatically bumps the version on substantive edits (title, description, acceptance criteria, target value, measurement method, priority, or type).
When a requirement reaches Approved or Met, an authorised user clicks Sign off. The Register records the user's name, ID, and timestamp, and writes a REQUIREMENT_SIGNED_OFF audit entry.
Audit trail
Every action emits an org-scoped audit row that is mirrored to the platform audit log:
REQUIREMENT_CREATEDREQUIREMENT_UPDATEDREQUIREMENT_STATUS_CHANGED(in addition to UPDATED, when status moves)REQUIREMENT_SIGNED_OFFREQUIREMENT_DELETED
Tier gating
The Register is available on Professional and Enterprise tiers when the organization has enabled ISO 42001 in Org Settings. On the Starter tier or with ISO 42001 disabled, the page renders a locked card explaining how to unlock it.