Data preparation

Define and document the criteria for choosing data preparation methods and the preparation methods to be used. In practice the record is documented criteria for selecting preparation methods. For data preparation the evidence starts with the provenance record.

What it asks

Define and document the criteria for choosing data preparation methods and the preparation methods to be used.

Where generative AI changes the answer

Preparation decisions such as redaction and chunking change what the system can reveal, so they belong in the risk record.

Who it binds

The data owner for the AI system and the team that builds or buys it. For A.7.6 the named role is the owner of documented criteria for selecting preparation methods.

Evidence an auditor normally samples

• Documented criteria for selecting preparation methods
• Record of methods and transforms applied per AI task (exploration, cleaning, imputation, normalization, scaling, labelling, encoding)

The test you can run

Compare documented criteria for selecting preparation methods with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Preparation steps applied ad hoc and unrecorded
• Imputation choices not justified

Before the draft publishes

For A.7.6, trace one output back to the data behind it. If you cannot, provenance is the first control to build. The first artefact to produce is documented criteria for selecting preparation methods.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.7.6 (data preparation) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.