ISO 42001 Annex A 7.2 Data for development and enhancement of AI system
What it says
The organization shall define, document and implement data management processes related to the development of AI systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSet up, write down and actually follow clear processes for managing the data you use to build and improve your AI systems.
When you build or improve an artificial intelligence (AI) system, it learns from data. This control says you must have proper, written-down processes for how that development data is handled at every step: how it is collected, where it is stored, how it is labelled or transformed, how versions are tracked, and how long it is kept. "Define, document and implement" means three things: agree the steps, write them down so they are not just in someone's head, and then genuinely work to them. The reason this matters is that the data is what shapes the AI. If different people on a project collect and prepare training data in their own ad hoc ways, you end up with an AI whose behaviour you cannot explain or rebuild. A worked example: a team trains a pricing model on a dataset, the model goes live, and months later the model starts behaving oddly. With documented data processes you can pull the exact dataset version, see how it was assembled, and fix the problem. Without them, nobody can reconstruct what the model was trained on, so you are stuck. This control is about the development data pipeline itself, not about teaching staff or running risk workshops.
Free. Save your status, tasks and notes.
Why it matters
Without defined and documented data-management processes, the dataset that trained a model often cannot be reconstructed: nobody recorded which records were pulled, how they were cleaned, or which version went into the model. When that model later misbehaves or a regulator asks you to justify it, you cannot retrain it on the same basis, trace its data lineage (the documented chain showing where each piece of data came from and how it was transformed), or even prove what it learned from. The system effectively has to be rebuilt from scratch or pulled from use.
How to implement
The data or AI lead should write a single data-management process for AI development that spells out, step by step, how data is collected, stored, labelled or transformed, versioned and retained, so every project handles development data the same way instead of improvising.
Whoever assembles training data should version each development dataset and record which version feeds each model, for example by tagging the dataset and noting that tag against the trained model, so you can always point back to the exact data a model learned from.
The data lead should keep lineage records that capture where each dataset came from and the cleaning, filtering and labelling steps applied, so a training dataset can be reproduced rather than reconstructed from guesswork later.
The data or AI lead should make the documented process easy to follow in practice by giving teams a short intake or preparation checklist to complete for each dataset, turning the written process into something that is actually implemented, not just filed.
Whoever owns the process should update both the process and the dataset documentation whenever a new data source is brought in, a collection or labelling method changes, or a model is retrained, so the records keep matching what the development pipeline really does.
Keep it running
Treat the documented data process as a living pipeline, not a one-off write-up: version each development dataset so you can always point to the exact data a given model was trained on. Whenever a new data source is added, a collection or labelling method changes, or a model is retrained, update the process and the dataset records together rather than waiting for an annual review. Keep older dataset versions and their documentation long enough to reproduce or investigate any model still in use.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the documented data-management process used when developing or enhancing AI systems.
Look at
Whether it actually names the development data steps (collection, storage, labelling or transformation, versioning and retention) rather than just saying data should be 'managed well'.
Good evidence
There is a written process that sets out concrete steps for handling development data from collection through to retention, with an owner and a last-reviewed date.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the dataset register or version log and pick one live AI model from it.
Look at
Whether you can see exactly which dataset version that model was trained on, and the date it was assembled.
Good evidence
Each AI model can be tied to a specific, dated dataset version that the organisation can still produce.
- Check 3 of 5What an auditor asks for
Ask for
Ask to see the data lineage or transformation records for one development dataset.
Look at
Whether the records show where the raw data came from and the steps used to clean, filter or label it into the final training set.
Good evidence
The transformation history is recorded clearly enough that someone could rebuild the same training dataset from the source data.
- Check 4 of 5What an auditor asks for
Ask for
Ask the AI or data lead to walk through how the documented process was followed on a recent development project.
Look at
Whether there is real evidence of the steps being done, such as a completed intake or preparation checklist, not just a policy that exists on paper.
Good evidence
The named process was demonstrably applied on a recent project, with completed records matching its steps.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the change history of the data process and dataset documentation.
Look at
Whether the records were updated when a new data source was added or a model was retrained, rather than left unchanged for a long period.
Good evidence
The process and dataset records show dated updates triggered by real data or model changes.
Mappings
Closest match in ASD Information Security Manual: ISM-2087, Verify the source and integrity of AI training data, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control supports A.5.10.
Annex A 7.2 requires the organisation to implement defined processes for managing data used in AI development and enhancement. ISO/IEC 27001:2022 Annex A 5.10 supports this by mandating acceptable use and handling procedures for information and assets, which can be extended to cover AI datasets, feature stores and data labelling environments. Annex A 5.10 is policy/behaviour focused and applies generally, while Annex A 7.2 is more specific to the end-to-end AI data management lifecycle.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-2087.
Annex A 7.2 requires defined, documented and implemented processes for managing data used to develop and enhance AI systems. ISM-2087 aligns by requiring verification of the source and integrity of AI training data, which is a specific data provenance and integrity component of AI data management. The overlap is limited to provenance/integrity assurance for training data; Annex A 7.2 is broader and expects a full set of data management processes across the AI lifecycle and dataset types (not only training inputs).
This control partially overlaps ISM-2088.
Annex A 7.2 requires the organisation to define, document and implement end-to-end data management processes for developing and enhancing AI systems. ISM-2088 relates by requiring validation and verification techniques to ensure the reliability and accuracy of AI model training data, which is a core activity within those data management processes. The overlap is specifically around data quality controls for training datasets, while Annex A 7.2 is broader and also covers governance, lineage, handling, retention and ongoing dataset management beyond accuracy checks.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents