What you tell people outside

The controls about what the organization tells people outside it: what a system does, how it was built, and how somebody affected by it can raise a concern.

• A.8.2Telling users what the system does and how to use it
• A.8.3A way for outsiders to report a problem with the system
• A.8.4Telling the people affected when an AI incident happens
• A.8.5Keeping other interested parties informed

Every control here needs an applicability decision and a justification in your Statement of Applicability, including the ones you exclude. See which clauses StandardOS covers.