Resource documentation

Identify and document the resources needed for the activities at each relevant AI life cycle stage and for other AI-related activities of the organization. In practice the record is resource inventory per AI system and life cycle stage (components, data, tooling, computing, people). For resource documentation the evidence is an inventory, not a statement.

What it asks

Identify and document the resources needed for the activities at each relevant AI life cycle stage and for other AI-related activities of the organization.

Where generative AI changes the answer

The resource record has to include the data, the evaluation sets and the human review capacity, because those are what the system actually consumes.

Who it binds

The AI system owner and the functions that supply data, tooling, computing and people. For A.4.2 the named role is the owner of resource inventory per AI system and life cycle stage (components, data, tooling, computing, people).

Evidence an auditor normally samples

• Resource inventory per AI system and life cycle stage (components, data, tooling, computing, people)
• Data flow or architecture diagrams
• Record of resources provided by customers or third parties

The test you can run

Compare resource inventory per AI system and life cycle stage (components, data, tooling, computing, people) with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Resource inventory covers infrastructure only
• Third-party provided resources not identified

Before the draft publishes

For A.4.2, list the data, tooling, computing and people the use depends on, and mark which of them the organisation does not control. The first artefact to produce is resource inventory per AI system and life cycle stage (components, data, tooling, computing, people).

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.4.2 (resource documentation) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.