Data resources

Within resource identification, document information about the data resources the AI system uses. In practice the record is data resource records covering provenance, last update date, ML data categories, labelling process, intended use, quality, retention and disposal, known bias and preparation. For data resources the evidence is an inventory, not a statement.

What it asks

Within resource identification, document information about the data resources the AI system uses.

Where generative AI changes the answer

Data resources for a generative system include the retrieval corpus and the prompt history, which are often owned by nobody and retained by default.

Reading it in practice

The data resources record for a generative system has to include the retrieval corpus and the prompt history, because those are what the system reads and keeps. The evidence is an inventory that names the owner, the retention rule and the lawful basis for each data set, including the ones nobody remembers adding.

Who it binds

The AI system owner and the functions that supply data, tooling, computing and people. For A.4.3 the named role is the owner of data resource records covering provenance, last update date, ML data categories, labelling process, intended use, quality, retention and disposal, known bias and preparation.

Evidence an auditor normally samples

• Data resource records covering provenance, last update date, ML data categories, labelling process, intended use, quality, retention and disposal, known bias and preparation

The test you can run

Compare data resource records covering provenance, last update date, ML data categories, labelling process, intended use, quality, retention and disposal, known bias and preparation with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Known bias in datasets undocumented
• No record of when data were last updated

Before the draft publishes

For A.4.3, list the data, tooling, computing and people the use depends on, and mark which of them the organisation does not control. The first artefact to produce is data resource records covering provenance, last update date, ML data categories, labelling process, intended use, quality, retention and disposal, known bias and preparation.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.4.3 (data resources) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.