Quality of Data for AI Systems
Write down what "good enough" data means for each AI system: things like accuracy, completeness, how current it is and how well it represents the people or cases it will be used on, then check that the data actually meets those standards, both when the system is built and while it is running.
Plain language
Data quality means deciding, in writing, what makes the data fed into your AI fit for its job (accurate, complete, up to date, and a fair representation of the real situations it will face) and then proving the data lives up to that. The standard cares about the data you train the model on (the historical examples it learns from) and the data it uses day to day once live (the inference data, meaning the fresh inputs it makes decisions from). For example, a hiring tool trained mostly on records from one age group can quietly score younger applicants unfairly, so checking the data is representative matters as much as checking it is accurate.
Framework
ISO/IEC 42001:2023
Control effect
Preventative
Classifications
N/A
Official last update
01 Dec 2023
Control Stack last updated
19 June 2026
Official control statement
The organisation shall define and document requirements for data quality and ensure that data used to develop and operate the AI system meet those requirements.
Why it matters
A loan-assessment AI trained on incomplete or stale income records can wrongly reject creditworthy applicants from a particular suburb or income band, exposing the organisation to an OAIC complaint and an anti-discrimination claim from that cohort. Poor training data also forces expensive model retraining and re-validation once the gap is found, and an external auditor who sees no documented quality criteria can raise a non-conformity that delays ISO 42001 certification. In the worst case a regulator or the organisation itself withdraws the system from use until the data is fixed.
Operational notes
Treat the quality criteria as a living spec tied to each dataset, not a one-off document: re-check accuracy, completeness and representativeness whenever a new data source is connected, a feed schema changes, or the population the model serves shifts. For operational (live) data, run automated checks on incoming records (missing-value rates, out-of-range values, unexpected category mixes) so a degraded feed is caught before it reaches the model rather than after a bad decision. Keep the sampled checks and their results with the dataset version they relate to, so you can show which data version trained which model. Where data comes from another team or an external source, agree the quality measures with them up front and validate each delivery against those measures rather than trusting it blind.
Implementation tips
- Get the data steward to write a short, dataset-specific quality spec for each AI system: say what 'fit for purpose' means in numbers, such as the accuracy level needed, the maximum share of missing or unknown values allowed, how recent records must be, and which population groups the data has to cover.
- Askthe data or ML team to profile the training data against that spec before the model is built, using a data profiling tool to count missing values, spot out-of-range entries and check category mixes, and to fix or exclude data that fails rather than training on it anyway
- Have the AI lead add automated quality checks to the live pipeline so the inference data (the fresh inputs the model scores in production) is checked on the way in (flagging missing fields, impossible values or an unexpected shift in the mix of records) and route failures to someone before they reach the model.
- Get whoever owns model fairness to run a representativeness check, comparing the data's distribution (age, location, product type, and similar) against the real population the system serves, and to flag and top up any group that is thin so the model is not learning from a skewed sample.
- Where data arrives from another team or an external provider, have the data owner agree the specific quality measures with them and validate each delivery against those measures (sampling and rejecting batches that fall short) so quality is confirmed at the point of intake rather than discovered later in production.
Audit / evidence tips
- AskRequest the documented data quality requirements for a named AI system.GoodThe specification lists concrete, measurable quality criteria for each dataset and names who owns and reviews them.
- AskRequest the validation or data profiling report for the data used to train or build that system.GoodThe report shows each criterion tested with pass or fail results against a named training dataset version, and any failures were resolved before the model was trained.
- AskAsk the data steward or AI lead how they check the live (inference) data the system uses day to day.GoodAutomated quality checks run on operational data, alerts are logged, and there is a recent example of a degraded feed being caught and handled before it affected a decision.
- AskRequest evidence that the data fairly represents the people or cases the AI is used on.GoodA documented check compares the data against the target population and any under-represented group was flagged and addressed.
- AskRequest the data-source register and the validation done on a recent delivery from an external or upstream feed.GoodEach external source has agreed quality measures and recent deliveries were validated against them with the results recorded.
Cross-framework mappings
How Annex A 7.4 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
handshakeSupports(2)expand_less | ||
| Annex A 8.9 | Annex A 7.4 requires defined and documented data quality requirements and assurance that AI training/operational data meets them | |
| Annex A 8.32 | Annex A 7.4 requires the organisation to define, document, and assure data quality requirements for data used to develop and operate AI s... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
handshakeSupports(1)expand_less | ||
| ISM-0042 | Annex A 7.4 requires the organisation to specify data quality requirements and ensure AI system data conforms to them | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 42001 controls in A.7 Data for AI systems
See all A.7 Data for AI systems controls, or browse the full ISO 42001 Annex A library.
Want to implement this AI control?
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.