Acquisition of data

Determine and document the details of how the data used in AI systems are acquired and selected. In practice the record is data acquisition records: categories and quantity needed, sources (internal, purchased, shared, open, synthetic), source characteristics, data subject demographics and known biases, prior handling, data rights (PII, copyright), metadata and provenance. For acquisition of data the evidence starts with the provenance record.

What it asks

Determine and document the details of how the data used in AI systems are acquired and selected.

Where generative AI changes the answer

Acquisition includes web-sourced and supplier-sourced data, where the rights and the personal data content are often undocumented.

Reading it in practice

Acquisition includes web-sourced, supplier-sourced and user-supplied data, where the rights and the personal data content are often undocumented. The evidence is a source register with the terms that apply, the personal data assessment and the decision to use or exclude each source. A crawler's terms are not a licence to train.

Who it binds

The data owner for the AI system and the team that builds or buys it. For A.7.3 the named role is the owner of data acquisition records: categories and quantity needed, sources (internal, purchased, shared, open, synthetic), source characteristics, data subject demographics and known biases, prior handling, data rights (PII, copyright), metadata and provenance.

Evidence an auditor normally samples

• Data acquisition records: categories and quantity needed, sources (internal, purchased, shared, open, synthetic), source characteristics, data subject demographics and known biases, prior handling, data rights (PII, copyright), metadata and provenance

The test you can run

Compare data acquisition records: categories and quantity needed, sources (internal, purchased, shared, open, synthetic), source characteristics, data subject demographics and known biases, prior handling, data rights (PII, copyright), metadata and provenance with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Data rights such as copyright or consent not recorded
• Synthetic or purchased data not distinguished

Before the draft publishes

For A.7.3, trace one output back to the data behind it. If you cannot, provenance is the first control to build. The first artefact to produce is data acquisition records: categories and quantity needed, sources (internal, purchased, shared, open, synthetic), source characteristics, data subject demographics and known biases, prior handling, data rights (PII, copyright), metadata and provenance.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.7.3 (acquisition of data) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.