Data Preparation
Organisations must set criteria and methods for preparing AI system data.
Plain language
To make sure your AI system does its job well, you need clear rules for choosing and preparing the data it learns from. Think of it like selecting the right ingredients for a recipe to avoid a bad-tasting dish. Without this, your AI could give customers wrong product recommendations because it's unknowingly learning from the wrong examples.
Framework
ISO/IEC 42001:2023
Control effect
Preventative
Classifications
N/A
Official last update
01 Dec 2023
Control Stack last updated
19 May 2026
Maturity levels
N/A
Official control statement
The organisation shall define and document its criteria for selecting data preparations and the data preparation methods to be used.
Why it matters
If your data preparation is not clear, the AI may give customers wrong advice or make suggestions that don't make sense, leading to lost trust and sales.
Operational notes
Every time you gather new data, revisit and validate your preparation methods to ensure ongoing quality and relevance for your AI.
Implementation tips
- The data steward should list what kind of training data the AI needs and why. You can create a simple checklist focusing on data type, source, and quality to ensure that only relevant data is used.
- The AI lead needs to pick the best methods for cleaning and preparing the data. For a small business, tools like Excel or Google Sheets can be used to sort out and correct any inconsistent data entries easily.
- Make sure the head of risk reviews the data preparation steps regularly. You could schedule a quarterly meeting to assess whether the data preparations still fit your business needs or if updates are needed as your business grows.
- The product owner should test the AI's outputs regularly to catch any off results early on. It's as simple as creating a basic form or survey to get customer feedback on current AI interactions.
- Procurement should add clauses in vendor contracts requiring updates on data preparation practices. A clear clause could direct vendors to notify you of any changes in their data processes, avoiding unexpected issues.
Audit / evidence tips
- AskAsk for the documented criteria used for selecting AI training data. GoodThe document clearly lists data types and why each type is selected, reflecting business needs.
- AskRequest the guidelines for data preparation methods. GoodGuidelines are detailed, showing how data is checked and prepared before use.
- AskRequest meeting notes from the last data preparation review. GoodNotes indicate a thorough review, with actions assigned and follow-ups scheduled.
- AskRequest the latest customer feedback on AI outputs. GoodFeedback is regularly collected, showing engagement and error identification.
- AskAsk for a vendor contract sample. GoodContracts contain specific clauses ensuring vendor responsibility over data preparation.
Cross-framework mappings
How Annex A 7.6 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
| handshake Supports (2) expand_less | ||
| Annex A 5.12 | Annex A 7.6 requires organisations to document criteria and methods for preparing data used by AI systems | |
| Annex A 5.37 | Annex A 7.6 requires the organisation to define and document criteria for selecting data preparations and the data preparation methods us... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Want to implement this AI control?
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.