Tooling resources

Within resource identification, document information about the tooling resources the AI system uses. In practice the record is tooling inventory listing algorithm types and models, data conditioning tools, optimization and evaluation methods, provisioning tools, model development aids and design, development and deployment software and hardware. For tooling resources the evidence is an inventory, not a statement.

What it asks

Within resource identification, document information about the tooling resources the AI system uses.

Where generative AI changes the answer

Tooling includes the evaluation harness, the guardrail configuration and the logging, and a system without them cannot produce the evidence an audit asks for.

Reading it in practice

Tooling for a generative system means the evaluation harness, the guardrail configuration and the logging. The evidence is a configuration record that shows what was tested, what the guardrails block and where the logs go. A system without them cannot produce the evidence an audit asks for, however good the model is.

Who it binds

The AI system owner and the functions that supply data, tooling, computing and people. For A.4.4 the named role is the owner of tooling inventory listing algorithm types and models, data conditioning tools, optimization and evaluation methods, provisioning tools, model development aids and design, development and deployment software and hardware.

Evidence an auditor normally samples

• Tooling inventory listing algorithm types and models, data conditioning tools, optimization and evaluation methods, provisioning tools, model development aids and design, development and deployment software and hardware

The test you can run

Compare tooling inventory listing algorithm types and models, data conditioning tools, optimization and evaluation methods, provisioning tools, model development aids and design, development and deployment software and hardware with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Open-source libraries and model hubs missing from the inventory

Before the draft publishes

For A.4.4, list the data, tooling, computing and people the use depends on, and mark which of them the organisation does not control. The first artefact to produce is tooling inventory listing algorithm types and models, data conditioning tools, optimization and evaluation methods, provisioning tools, model development aids and design, development and deployment software and hardware.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.4.4 (tooling resources) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.