# A.7.2 Data for development and enhancement of AI system

Set up, write down and operate processes for managing the data used to develop AI systems. In practice the record is data management process for AI development covering privacy and security implications, data-related security and safety threats, transparency and provenance, representativeness of training data and data accuracy and integrity. For data for development and enhancement of ai system the evidence starts with the provenance record.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.7.2
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Set up, write down and operate processes for managing the data used to develop AI systems.

## Where generative AI changes the answer

Data for development includes the fine-tuning set and the evaluation set, and a contaminated evaluation set will hide a failure rather than reveal it.

## Who it binds

The data owner for the AI system and the team that builds or buys it.

## Evidence an auditor samples

- Data management process for AI development covering privacy and security implications, data-related security and safety threats, transparency and provenance, representativeness of training data and data accuracy and integrity

## The test you can run

Ask for the provenance of one document in the retrieval corpus, and for the redaction decision on it.

## Common failures

- Representativeness of training data against the domain of use not checked
- Sensitive data used without privacy review

## Before the draft publishes

Trace one output back to the data behind it. If you cannot, provenance is the first control to build.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.