ISO 42001 Annex A 4.3 Document the data resources used by your AI system
What it says
As part of resource identification, the organization shall document information about the data resources utilized for the AI system.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation must keep a written record of the data resources used by each artificial intelligence (AI) system.
Artificial intelligence (AI) systems run on data. They learn from data, are tested with data and produce results from data. This control says that when your organisation identifies the resources needed to build and run an AI system, you must also write down clear information about the data those systems use. In plain terms, you keep a record that answers questions like: where did the data come from, what does it contain, who is allowed to use it, and how good or reliable is it. Documenting your data resources matters because data quietly drives everything an AI system does. If the data is out of date, biased, low quality or used without permission, the AI's results will be flawed too, and you may not realise why. Having a written record means anyone reviewing the AI later (your own staff, an auditor or a regulator) can see exactly what data feeds it. This is part of an AI management system (AIMS), which is the set of policies, roles and records your organisation uses to run AI responsibly. The control is about keeping good records of your data, not about judging whether the AI's decisions are fair.
Free. Save your status, tasks and notes.
Why it matters
Without a record of what data feeds your AI, you cannot trace flawed or unauthorised data, leaving results unreliable and use rights unclear.
How to implement
The AI or data lead should create a data resources register that lists every dataset used to train, test and run each AI system, recording its name, purpose and the AI system it supports.
For each dataset, the data owner should record its source (for example purchased, collected from customers, or publicly available) and the licence, contract or consent that gives your organisation the right to use it.
The data lead should capture key details about each dataset, including its size, format, the time period it covers, how current it is, and any known quality limitations or gaps.
Compliance staff should note whether a dataset contains personal or sensitive information and link the record to the relevant privacy approval, so data protection obligations are visible alongside the data itself.
The AIMS owner should set a simple rule that the data resources register is updated whenever a new dataset is added or an AI system is retrained, and reviewed at planned intervals to keep it accurate.
Keep it running
Update the data resources register whenever a dataset is added, changed or an AI system is retrained, not only at the annual review.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
the data resources register or equivalent documentation, and check that it covers each AI system the organisation operates rather than just one or two.
Look at
whether each dataset entry records its source and the licence, contract or consent permitting its use, confirming the organisation has the right to use the data.
- Check 2 of 3What an auditor asks for
Ask for
how data quality is described, and good evidence shows recorded details such as size, coverage, currency and known limitations for each dataset.
Look at
whether datasets containing personal or sensitive information are flagged and linked to a privacy approval, showing data protection is considered in the records.
- Check 3 of 3What an auditor asks for
Ask for
when the documentation was last updated, and good practice is a register kept current when datasets change or AI systems are retrained, with a named owner responsible.
Mappings
Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.9.
Annex A 4.3 requires the organisation to document information about the data resources utilised for an AI system as part of resource identification. Annex A 5.9 similarly requires an inventory of information and associated assets (including owners), which can include AI training, test and operational datasets and data pipelines. The overlap is on identifying and documenting data as an organisational resource, but Annex A 4.3 is AI-system specific (including AI lifecycle context), while Annex A 5.9 is a general information asset inventory control.
This control partially overlaps A.5.34.
Annex A 4.3 requires documenting the AI system's data resources, which often includes identifying whether datasets contain personal information and the provenance/usage constraints of that data. Annex A 5.34 requires the organisation to identify and meet privacy and PII protection requirements, which directly intersects when AI data resources include PII. The overlap is on knowing and governing data used, but Annex A 5.34 is primarily a legal/regulatory privacy compliance control, while Annex A 4.3 is broader AI data resource documentation regardless of whether PII is present.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-2087.
Annex A 4.3 requires documenting the data resources utilised for the AI system. ISM-2087 necessitates verification of source and integrity of AI training data. The overlap involves provenance and integrity checks being typically part of AI data documentation, focusing on different aspects of data handling.
This control partially overlaps ISM-2134.
Annex A 4.3 requires the organisation to document information about the data resources utilised by an AI system. ISM-2134 requires maintaining an AI agent register, which typically includes information about AI agents and may reference its data resources. The overlap is both drive documentation for AI, but ISM-2134 is broader about registering AI agents, while Annex A 4.3 focuses on documenting data resources.
- ISM-2135Recording identifier, owner, identities, credentials and access for each AI agentPartially overlaps
This control partially overlaps ISM-2135.
ISM-2135 requires an AI agent register entry listing data repositories accessible to each AI agent. Annex A 4.3 requires documenting the data resources used for AI systems, identifying repositories within scope for access recording. Annex A 4.3 involves broader data-resource documentation, whereas ISM-2135 links specific agents to data repositories and permissions in a security context.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents