ISO 42001 Annex A 4.5 Document system and computing resources used by AI systems
What it says
As part of resource identification, the organization shall document information about the system and computing resources utilized for the AI system.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation keeps a written record of the system and computing resources used to run each artificial intelligence (AI) system.
This control is about keeping a clear record of the computing resources your AI (artificial intelligence) systems rely on. As part of working out what resources your AI management system (AIMS) needs, your organisation must write down the system and computing resources each AI system uses. That means listing things like the servers, cloud services, processing power (for example, the CPUs or GPUs that do the heavy lifting), memory, storage, and networks that let the AI run. Think of it like an asset register, but for the technology behind your AI. If you do not know what your AI runs on, you cannot plan for it, budget for it, secure it, or keep it working reliably. For example, if a forecasting AI quietly depends on a particular cloud service, and nobody recorded that, you could lose the service in a contract change and only discover the dependency when the AI stops working. Writing it down up front means everyone knows what is needed, who provides it, and what would happen if it changed.
Free. Save your status, tasks and notes.
Why it matters
Without a record of the resources AI systems rely on, hidden dependencies, capacity shortfalls, and outages can go unnoticed until something breaks.
How to implement
The AI lead should build a simple register that lists, for each AI system, the computing resources it uses: servers, cloud platforms and services, processing hardware such as CPUs and GPUs, memory, storage, and network connections.
The IT or infrastructure manager should record whether each resource is owned in-house or supplied by an external provider, and note the provider name and contract reference so dependencies on third parties are visible.
System owners should capture the scale and capacity of each resource, such as how much processing power, memory, and storage the AI needs to run and to be trained, so the organisation can plan and budget accurately.
The AI lead should keep the register up to date by reviewing it whenever a new AI system is introduced or an existing one changes platforms, hardware, or hosting arrangements.
The compliance manager should store the register in a central, access-controlled location and link it to the wider asset inventory so it can be found during planning, audits, and incident response.
Keep it running
Update the resource record whenever an AI system is added, retired, or moved to different hardware, cloud services, or hosting arrangements.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
the documented record of system and computing resources used by the organisation's AI systems, and confirm it exists as a maintained document rather than informal knowledge.
Look at
whether the record covers the real components an AI system depends on, such as servers, cloud services, processing hardware (CPUs or GPUs), memory, storage, and networks, not just a single line entry.
- Check 2 of 2What an auditor asks for
Ask for
how external dependencies are captured and check that the record names third-party providers and the services supplied, so reliance on outside infrastructure is clear.
Look at
the dates and version history to confirm the record is kept current and was updated when AI systems were added or their hosting or hardware changed.
Good evidence
a clear, current resource register tied to each AI system, showing what runs where, who provides it, and the capacity involved, and held in a controlled, findable location.
Mappings
Closest match in ASD Information Security Manual: ISM-0336, Develop and maintain networked IT equipment register, which partially overlaps with this control.
ASD Information Security Manual: 4 mappings
This control partially overlaps ISM-0336.
Annex A 4.5 requires the organisation to document the system and computing resources utilised for each AI system. ISM-0336 requires a maintained and regularly verified register of networked IT equipment, which directly provides documented evidence of servers, appliances and other equipment that can constitute the compute environment an AI system runs on. ISM-0336 is enterprise-wide and equipment-centric, while Annex A 4.5 is AI-system-centric and expects the documented resources to be explicitly associated with the relevant AI system(s) (including non-equipment resources such as logical environments).
This control partially overlaps ISM-1493.
Annex A 4.5 requires documentation of the system and computing resources utilised for an AI system. ISM-1493 mandates developed, maintained and verified software registers for workstations, servers, network devices and networked IT equipment, which directly documents software components (e.g., operating systems, runtimes, supporting services) that may be part of the AI system’s computing stack. ISM-1493 does not require linking software entries to a specific AI system, whereas Annex A 4.5 is specifically about documenting the resources used by a given AI system.
This control partially overlaps ISM-1643.
Annex A 4.5 requires the organisation to document the system and computing resources utilised for an AI system. ISM-1643 strengthens the documentation quality of those resources by requiring software registers to include versions and patch histories for applications, drivers, operating systems and firmware used in the computing environment. ISM-1643 is a depth requirement for software register content across the organisation, while Annex A 4.5 is broader across system/compute resources but requires AI-system-specific scoping and association.
This control supports ISM-2134.
Annex A 4.5 requires the organisation to document the system and computing resources utilised for the AI system. ISM-2134 requires an AI agent register to be developed, maintained and regularly verified, providing an authoritative inventory anchor that helps ensure each AI capability is identified and can have its associated system/compute resources documented against it. ISM-2134 focuses on registering AI agents as assets, while Annex A 4.5 focuses on documenting the underlying system and computing resources used to operate the AI system (which may extend beyond agents).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents