# A.7.5 Data provenance

Set out a documented way of keeping a record of where data used in AI systems come from and how they change, over the life of both the data and the system. In practice the record is provenance records covering creation, update, transcription, abstraction, validation, transfer of control, sharing and transformation. For data provenance the evidence starts with the provenance record.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.7.5
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Set out a documented way of keeping a record of where data used in AI systems come from and how they change, over the life of both the data and the system.

## Where generative AI changes the answer

Provenance is what lets the organisation answer a complaint about where a generated statement came from.

## Who it binds

The data owner for the AI system and the team that builds or buys it.

## Evidence an auditor samples

- Provenance records covering creation, update, transcription, abstraction, validation, transfer of control, sharing and transformation
- Decision on whether provenance verification measures are needed

## The test you can run

Ask for the provenance of one document in the retrieval corpus, and for the redaction decision on it.

## Common failures

- Provenance lost after data transformations
- No verification for third-party data

## Before the draft publishes

Trace one output back to the data behind it. If you cannot, provenance is the first control to build.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.