# A.4.2 Resource documentation

Identify and document the resources needed for the activities at each relevant AI life cycle stage and for other AI-related activities of the organization. In practice the record is resource inventory per AI system and life cycle stage (components, data, tooling, computing, people). For resource documentation the evidence is an inventory, not a statement.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.4.2
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Identify and document the resources needed for the activities at each relevant AI life cycle stage and for other AI-related activities of the organization.

## Where generative AI changes the answer

The resource record has to include the data, the evaluation sets and the human review capacity, because those are what the system actually consumes.

## Who it binds

The AI system owner and the functions that supply data, tooling, computing and people.

## Evidence an auditor samples

- Resource inventory per AI system and life cycle stage (components, data, tooling, computing, people)
- Data flow or architecture diagrams
- Record of resources provided by customers or third parties

## The test you can run

Ask for the data and tooling inventory for the use, and check that the evaluation set is in it.

## Common failures

- Resource inventory covers infrastructure only
- Third-party provided resources not identified

## Before the draft publishes

List the data, tooling, computing and people the use depends on, and mark which of them the organisation does not control.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.