ISO 42001 Annex A 7.4 Quality of data for AI systems
What it says
The organization shall define and document requirements for data quality and ensure that data used to develop and operate the AI system meet those requirements.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWrite down what "good enough" data means for each AI system: things like accuracy, completeness, how current it is and how well it represents the people or cases it will be used on, then check that the data actually meets those standards, both when the system is built and while it is running.
Data quality means deciding, in writing, what makes the data fed into your AI fit for its job (accurate, complete, up to date, and a fair representation of the real situations it will face) and then proving the data lives up to that. The standard cares about the data you train the model on (the historical examples it learns from) and the data it uses day to day once live (the inference data, meaning the fresh inputs it makes decisions from). For example, a hiring tool trained mostly on records from one age group can quietly score younger applicants unfairly, so checking the data is representative matters as much as checking it is accurate.
Free. Save your status, tasks and notes.
Why it matters
A loan-assessment AI trained on incomplete or stale income records can wrongly reject creditworthy applicants from a particular suburb or income band, exposing the organisation to an OAIC complaint and an anti-discrimination claim from that cohort. Poor training data also forces expensive model retraining and re-validation once the gap is found, and an external auditor who sees no documented quality criteria can raise a non-conformity that delays ISO 42001 certification. In the worst case a regulator or the organisation itself withdraws the system from use until the data is fixed.
How to implement
Get the data steward to write a short, dataset-specific quality spec for each AI system: say what 'fit for purpose' means in numbers, such as the accuracy level needed, the maximum share of missing or unknown values allowed, how recent records must be, and which population groups the data has to cover.
Ask the data or ML team to profile the training data against that spec before the model is built, using a data profiling tool to count missing values, spot out-of-range entries and check category mixes, and to fix or exclude data that fails rather than training on it anyway.
Have the AI lead add automated quality checks to the live pipeline so the inference data (the fresh inputs the model scores in production) is checked on the way in (flagging missing fields, impossible values or an unexpected shift in the mix of records) and route failures to someone before they reach the model.
Get whoever owns model fairness to run a representativeness check, comparing the data's distribution (age, location, product type, and similar) against the real population the system serves, and to flag and top up any group that is thin so the model is not learning from a skewed sample.
Where data arrives from another team or an external provider, have the data owner agree the specific quality measures with them and validate each delivery against those measures (sampling and rejecting batches that fall short) so quality is confirmed at the point of intake rather than discovered later in production.
Keep it running
Treat the quality criteria as a living spec tied to each dataset, not a one-off document: re-check accuracy, completeness and representativeness whenever a new data source is connected, a feed schema changes, or the population the model serves shifts. For operational (live) data, run automated checks on incoming records (missing-value rates, out-of-range values, unexpected category mixes) so a degraded feed is caught before it reaches the model rather than after a bad decision. Keep the sampled checks and their results with the dataset version they relate to, so you can show which data version trained which model. Where data comes from another team or an external source, agree the quality measures with them up front and validate each delivery against those measures rather than trusting it blind.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the documented data quality requirements for a named AI system.
Look at
Whether the criteria are specific and measurable (e.g. a stated maximum missing-value rate, a freshness limit, required population coverage) rather than vague words like 'accurate' and 'reliable'.
Good evidence
The specification lists concrete, measurable quality criteria for each dataset and names who owns and reviews them.
- Check 2 of 5What an auditor asks for
Ask for
Request the validation or data profiling report for the data used to train or build that system.
Look at
Whether the report measures the actual data against the documented criteria and ties to a specific dataset version.
Good evidence
The report shows each criterion tested with pass or fail results against a named training dataset version, and any failures were resolved before the model was trained.
- Check 3 of 5What an auditor asks for
Ask for
Ask the data steward or AI lead how they check the live (inference) data the system uses day to day.
Look at
Whether checks run on incoming data (such as missing-value or out-of-range alerts) and not only on the original training set.
Good evidence
Automated quality checks run on operational data, alerts are logged, and there is a recent example of a degraded feed being caught and handled before it affected a decision.
- Check 4 of 5What an auditor asks for
Ask for
Request evidence that the data fairly represents the people or cases the AI is used on.
Look at
Whether a representativeness or coverage check exists comparing the data distribution against the real population.
Good evidence
A documented check compares the data against the target population and any under-represented group was flagged and addressed.
- Check 5 of 5What an auditor asks for
Ask for
Request the data-source register and the validation done on a recent delivery from an external or upstream feed.
Look at
Whether incoming data from outside the team is validated against the agreed quality measures, not accepted on trust.
Good evidence
Each external source has agreed quality measures and recent deliveries were validated against them with the results recorded.
Mappings
Closest match in ASD Information Security Manual: ISM-2087, Verify the source and integrity of AI training data, which partially overlaps with this control.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-2087.
Annex A 7.4 demands documented data quality requirements to ensure AI development and operational data meets those standards. ISM-2087 requires verifying the source and integrity of AI training data, addressing the provenance and integrity aspects of Annex A 7.4’s framework. Annex A 7.4 extends its focus to additional quality attributes and encompasses all data used in AI operations. The overlap lies in their mutual emphasis on integrity and provenance assurances.
This control partially overlaps ISM-2088.
Annex A 7.4 requires the organisation to define, document and verify data quality requirements for data used to develop and operate AI systems, emphasising dimensions such as accuracy and completeness. ISM-2088 focuses specifically on using data validation techniques to ensure the reliability and accuracy of AI model training data, which aligns with the quality verification activities in Annex A 7.4. While Annex A 7.4 is broader, encompassing various quality dimensions and applications beyond training data, the overlap occurs in the shared goal of ensuring data reliability.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents