# A.7.3 Acquisition of data

Determine and document the details of how the data used in AI systems are acquired and selected. In practice the record is data acquisition records: categories and quantity needed, sources (internal, purchased, shared, open, synthetic), source characteristics, data subject demographics and known biases, prior handling, data rights (PII, copyright), metadata and provenance. For acquisition of data the evidence starts with the provenance record.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.7.3
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Determine and document the details of how the data used in AI systems are acquired and selected.

## Where generative AI changes the answer

Acquisition includes web-sourced and supplier-sourced data, where the rights and the personal data content are often undocumented.

## Who it binds

The data owner for the AI system and the team that builds or buys it.

## Evidence an auditor samples

- Data acquisition records: categories and quantity needed, sources (internal, purchased, shared, open, synthetic), source characteristics, data subject demographics and known biases, prior handling, data rights (PII, copyright), metadata and provenance

## The test you can run

Ask for the provenance of one document in the retrieval corpus, and for the redaction decision on it.

## Common failures

- Data rights such as copyright or consent not recorded
- Synthetic or purchased data not distinguished

## Before the draft publishes

Trace one output back to the data behind it. If you cannot, provenance is the first control to build.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.