Data for development and enhancement of AI system

Set up, write down and operate processes for managing the data used to develop AI systems. In practice the record is data management process for AI development covering privacy and security implications, data-related security and safety threats, transparency and provenance, representativeness of training data and data accuracy and integrity. For data for development and enhancement of ai system the evidence starts with the provenance record.

What it asks

Set up, write down and operate processes for managing the data used to develop AI systems.

Where generative AI changes the answer

Data for development includes the fine-tuning set and the evaluation set, and a contaminated evaluation set will hide a failure rather than reveal it.

Reading it in practice

Data for development includes the fine-tuning set and the evaluation set, and a contaminated evaluation set will hide a failure rather than reveal it. The evidence is a data sheet that names the source, the collection date and the checks that kept the evaluation data out of the training data.

Who it binds

The data owner for the AI system and the team that builds or buys it. For A.7.2 the named role is the owner of data management process for AI development covering privacy and security implications, data-related security and safety threats, transparency and provenance, representativeness of training data and data accuracy and integrity.

Evidence an auditor normally samples

• Data management process for AI development covering privacy and security implications, data-related security and safety threats, transparency and provenance, representativeness of training data and data accuracy and integrity

The test you can run

Compare data management process for AI development covering privacy and security implications, data-related security and safety threats, transparency and provenance, representativeness of training data and data accuracy and integrity with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Representativeness of training data against the domain of use not checked
• Sensitive data used without privacy review

Before the draft publishes

For A.7.2, trace one output back to the data behind it. If you cannot, provenance is the first control to build. The first artefact to produce is data management process for AI development covering privacy and security implications, data-related security and safety threats, transparency and provenance, representativeness of training data and data accuracy and integrity.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.7.2 (data for development and enhancement of ai system) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.