ISO 42001 Annex A 7.3 Acquisition and selection of data
What it says
The organization shall determine and document details about the acquisition and selection of the data used in AI systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWrite down where each dataset feeding your AI came from and the criteria you used to decide it was the right data to use.
When you build or train an AI system you have to feed it data, and this control says you must record two things for every dataset: where it came from (acquisition) and why you chose it over alternatives (selection). For example, if a recruitment tool is trained on ten years of past hiring records, you note that source, who collected it, and the reasoning that made it a sensible fit, so anyone can later check the data was suitable and you were allowed to use it.
Free. Save your status, tasks and notes.
Why it matters
If you cannot show where your training data came from, you may discover too late that it was scraped or repurposed without a lawful basis, forcing you to retrain or withdraw the AI system because the model is built on data you had no right to use. A complainant can take a privacy concern to the OAIC, and without acquisition records you cannot demonstrate the data was collected fairly or with consent. Poorly chosen data also bakes in problems you cannot trace: a credit or hiring model trained on an unrepresentative dataset can quietly disadvantage a whole cohort of applicants.
How to implement
The data lead should keep a dataset register that, for every dataset feeding an AI system, records the origin, who collected it, the date range, and a link to the lawful basis or licence; a simple table per dataset version is enough as long as it is filled in when the data is acquired.
For data bought or licensed from an outside source, whoever arranges the acquisition should capture the supplier's name, what the data is, and the licence terms that permit AI training, and file that alongside the dataset so the right to use it is documented at the point of acquisition.
Whoever selects a dataset for a model should write a short selection rationale noting why this data fits the AI system's intended use, for example its coverage, recency, or representativeness, so the choice is traceable rather than implicit.
The data lead should also log datasets that were considered and rejected, with the reason, so unsuitable sources are not quietly re-introduced later and so selection decisions are documented, not just the data that made the cut.
Tie each acquisition and selection record to a specific dataset version or snapshot identifier, so that when data is refreshed or re-sourced the new origin and rationale are captured against the new version instead of overwriting the original.
Keep it running
Record acquisition and selection details at the moment a dataset is brought in, before it reaches a training pipeline, because reconstructing provenance (the documented history of where data came from and how it was handled) months later is usually impossible. Keep the record tied to a specific dataset version or snapshot, so when you refresh or re-source data you capture the new origin and selection rationale rather than overwriting the old one. When a dataset is rejected during selection, note why, so the same unsuitable source is not picked up again later.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask the data lead for the provenance record of a specific dataset used to train one of the organisation's AI systems.
Look at
Whether it names a concrete origin (which system, dataset, or supplier), who collected the data, and the date range it covers, rather than just saying 'internal data'.
Good evidence
Each dataset has a provenance record naming its source, collector, and time period, and the auditor can trace it to a real origin.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the documented lawful basis or licence covering the dataset used in that AI system.
Look at
Whether there is a specific reference to consent, a licence, or a terms-of-use agreement permitting use of the data for AI training, not a general assertion that 'we own our data'.
Good evidence
The record cites a specific lawful basis or licence that clearly permits using the dataset to train the AI system.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the selection rationale showing why this dataset was chosen for the AI system.
Look at
Whether it explains the choice against the AI system's intended use, for example coverage, representativeness, or recency, rather than just listing what was available.
Good evidence
The selection rationale explains why the dataset fits the intended use and what was considered before choosing it.
- Check 4 of 5What an auditor asks for
Ask for
Ask to see the dataset register and pick one entry at random.
Look at
Whether the chosen entry links a specific dataset version to both its acquisition details and its selection rationale.
Good evidence
The register links each dataset version to its documented origin and the reason it was selected.
- Check 5 of 5What an auditor asks for
Ask for
Ask whether any candidate datasets were considered and then rejected, and for the record of that decision.
Look at
Whether there is a note of at least one rejected source with the reason it was unsuitable.
Good evidence
There is a record of rejected datasets with clear reasons, showing selection decisions are documented, not just acquisitions.
Mappings
Closest match in ASD Information Security Manual: ISM-2087, Verify the source and integrity of AI training data, which partially overlaps with this control.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-2087.
Annex A 7.3 requires the organisation to determine and document details about how data for AI systems is acquired and selected, including provenance and selection criteria. This overlaps with ISM-2087 because verifying the source and integrity of AI training data relies on knowing and recording where the training data came from and what was accepted into the training corpus. ISM-2087 is more security-integrity focused (verification/assurance), whereas Annex A 7.3 is broader governance documentation across acquisition and selection for all AI data types, not only training data.
This control partially overlaps ISM-2088.
Annex A 7.3 requires the organisation to document the acquisition sources and selection criteria for data used in AI systems. This relates to ISM-2088 because data validation and verification to ensure reliability and accuracy are often part of the documented selection criteria and acceptance checks for training datasets. ISM-2088 focuses on technical validation quality controls for training data, while Annex A 7.3 is a governance requirement to record acquisition and selection details that apply beyond training data.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents