# A.7.6 Data preparation

Define and document the criteria for choosing data preparation methods and the preparation methods to be used. In practice the record is documented criteria for selecting preparation methods. For data preparation the evidence starts with the provenance record.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.7.6
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Define and document the criteria for choosing data preparation methods and the preparation methods to be used.

## Where generative AI changes the answer

Preparation decisions such as redaction and chunking change what the system can reveal, so they belong in the risk record.

## Who it binds

The data owner for the AI system and the team that builds or buys it.

## Evidence an auditor samples

- Documented criteria for selecting preparation methods
- Record of methods and transforms applied per AI task (exploration, cleaning, imputation, normalization, scaling, labelling, encoding)

## The test you can run

Ask for the provenance of one document in the retrieval corpus, and for the redaction decision on it.

## Common failures

- Preparation steps applied ad hoc and unrecorded
- Imputation choices not justified

## Before the draft publishes

Trace one output back to the data behind it. If you cannot, provenance is the first control to build.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.