ISO 42001 Annex A 4.2 Resource documentation
What it says
The organization shall identify and document relevant resources required for the activities at given AI system life cycle stages and other AI-related activities relevant for the organization.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe organisation identifies and documents the resources needed for each stage of an AI system's life cycle and for any other AI-related work it carries out. Resources include data, computing power, tooling, and the skilled people who build and run the system.
An AI system needs things to do its job, much like a new staff member needs a desk, a laptop, and access to the right files. Those things include the data the model learns from, the computing power and software that run it, and the people with the skills to build, check, and operate it. This control asks you to write down what each of those resources is, and which stage of the AI's life it belongs to (for example, gathering data, training the model, testing it, running it day to day, or retiring it). When something goes wrong, say the model starts giving poor answers, a clear written list lets you see quickly what is missing, out of date, or broken, rather than guessing.
Free. Save your status, tasks and notes.
Why it matters
Without a written record of the resources each AI activity depends on, the team relies on memory, so a single staff departure or an expired data licence can quietly stall a project. Gaps in computing power, tooling, or skills tend to surface only after the AI starts producing poor results or stops working altogether. Documenting resources up front turns these surprises into items you can plan for and budget against.
How to implement
List the resources each AI activity depends on, working stage by stage through the life cycle (gathering data, training, testing, running, and retiring the system); a single spreadsheet is enough to begin with.
Record where each data set comes from, when it was obtained, and what it may be used for, so a licence ending or a source changing does not catch the project off guard.
Track how much computing power and storage the system uses against what is available, and note the point at which capacity needs to grow before performance suffers.
Confirm at least once a year that suppliers of key software, models, and cloud services can still meet what the AI needs, and write down the outcome of each check.
Name the skills and the people behind each activity, and add a fallback for the resources you cannot do without, so a single absence or outage does not halt the work.
Keep it running
Keep one register that maps each resource (data sets, computing and storage, software and models, and the people or skills involved) to the life cycle stage it supports. Update it whenever you add a data source, change a supplier, scale the infrastructure, or shift responsibilities, so the record matches what the system actually uses. A shared spreadsheet or a page in your existing asset register is enough to start; the point is that it stays current and someone owns it.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask to see the AI resource register.
Look at
Check that it covers data, computing and storage, software and models, and skills, with each item tied to a life cycle stage.
Good evidence
The register covers every resource type and maps each one to the relevant stage of the AI life cycle.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the record of data sources behind the AI.
Look at
Look for the origin of each data set, the date it was obtained, and any limits on its use.
Good evidence
The data source record is complete and current for every data set the AI relies on.
- Check 3 of 5What an auditor asks for
Ask for
Ask for a recent report on computing and storage use.
Look at
Check that it shows actual usage against available capacity and flags where limits are close.
Good evidence
The report shows current usage against capacity and confirms there are no unaddressed shortfalls.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the latest supplier or licence confirmations for key AI tooling and services.
Look at
Check that confirmations have been gathered within the last year and cover the resources the AI depends on.
Good evidence
Supplier and licence confirmations are on file, current, and cover every critical resource.
- Check 5 of 5What an auditor asks for
Ask for
Ask how the organisation copes when a key AI resource or skilled person is unavailable.
Look at
Look for named fallbacks for critical resources and the people responsible for each activity.
Good evidence
Documented fallbacks exist for every critical resource and name who is responsible.
Mappings
Closest match in ASD Information Security Manual: ISM-2135, Recording identifier, owner, identities, credentials and access for each AI agent, which partially overlaps with this control.
ASD Information Security Manual: 2 mappings
- ISM-2135Recording identifier, owner, identities, credentials and access for each AI agentPartially overlaps
This control partially overlaps ISM-2135.
Annex A 4.2 requires the organisation to identify and document the resources needed at each AI system life cycle stage (e.g. people, data, tooling, compute). ISM-2135 relates by requiring detailed documentation of AI-agent-specific operational resources and dependencies (identifiers, ownership, identities/credentials, and accessible tools/data repositories) that are part of what must be resourced and documented to run and govern AI agents. ISM-2135 is narrower and security-focused on access and accountability for agents, whereas Annex A 4.2 is broader resource documentation across all AI activities and life cycle stages.
This control supports ISM-2134.
Annex A 4.2 requires identifying and documenting resources required for AI life cycle stages and AI-related activities. ISM-2134 supports this by establishing a maintained and verified AI agent register, which becomes a practical artefact for capturing AI-agent resources (owners, purposes, and operational dependencies) in a controlled way. ISM-2134 focuses on the governance process for maintaining the register, while Annex A 4.2 focuses on completeness of resource identification/documentation across the AI life cycle.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents