Data provenance

Set out a documented way of keeping a record of where data used in AI systems come from and how they change, over the life of both the data and the system. In practice the record is provenance records covering creation, update, transcription, abstraction, validation, transfer of control, sharing and transformation. For data provenance the evidence starts with the provenance record.

What it asks

Set out a documented way of keeping a record of where data used in AI systems come from and how they change, over the life of both the data and the system.

Where generative AI changes the answer

Provenance is what lets the organisation answer a complaint about where a generated statement came from.

Who it binds

The data owner for the AI system and the team that builds or buys it. For A.7.5 the named role is the owner of provenance records covering creation, update, transcription, abstraction, validation, transfer of control, sharing and transformation.

Evidence an auditor normally samples

• Provenance records covering creation, update, transcription, abstraction, validation, transfer of control, sharing and transformation
• Decision on whether provenance verification measures are needed

The test you can run

Compare provenance records covering creation, update, transcription, abstraction, validation, transfer of control, sharing and transformation with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Provenance lost after data transformations
• No verification for third-party data

Before the draft publishes

For A.7.5, trace one output back to the data behind it. If you cannot, provenance is the first control to build. The first artefact to produce is provenance records covering creation, update, transcription, abstraction, validation, transfer of control, sharing and transformation.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.7.5 (data provenance) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.