System and computing resources

As part of identifying resources, record details of the computing and system resources the AI system relies on. In practice the record is computing resource records: requirements, location (on-premises, cloud, edge), processing, network and storage. For system and computing resources the evidence is an inventory, not a statement.

What it asks

As part of identifying resources, record details of the computing and system resources the AI system relies on.

Where generative AI changes the answer

Computing resources decide whether outputs are complete and whether logs are kept long enough to reconstruct an incident.

Who it binds

The AI system owner and the functions that supply data, tooling, computing and people. For A.4.5 the named role is the owner of computing resource records: requirements, location (on-premises, cloud, edge), processing, network and storage.

Evidence an auditor normally samples

• Computing resource records: requirements, location (on-premises, cloud, edge), processing, network and storage
• Assessment of hardware impacts including environmental and cost
• Resource needs per life cycle stage

The test you can run

Compare computing resource records: requirements, location (on-premises, cloud, edge), processing, network and storage with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Environmental impact of compute never considered
• Development and production resource needs not distinguished

Before the draft publishes

For A.4.5, list the data, tooling, computing and people the use depends on, and mark which of them the organisation does not control. The first artefact to produce is computing resource records: requirements, location (on-premises, cloud, edge), processing, network and storage.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.4.5 (system and computing resources) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.