ISO 42001 Annex A 7.6 Data preparation
What it says
The organization shall define and document its criteria for selecting data preparations and the data preparation methods to be used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWrite down how your organisation decides which data-preparation steps to apply and which methods to use, so data is shaped consistently before it trains or feeds an AI system.
Before raw data can be used by an AI system, it usually needs work: removing errors, filling gaps, putting values on a common scale, and labelling examples. This control says you must write down the rules for which of these preparation steps you apply and which methods you use, rather than leaving it to whoever happens to be doing the job that week. Data preparation here means the tidying and shaping of data (for example cleaning, de-duplication, normalising values to a common range, and splitting data into training and testing sets) done before a model learns from it.
Free. Save your status, tasks and notes.
Why it matters
If nobody has written down the criteria and methods, two people preparing the same dataset will make different choices (one drops rows with missing values, another fills them with a guessed average) and the model's behaviour shifts without anyone knowing why. Mislabelled or unbalanced training data can bake in a bias that later surfaces as, for example, a loan-screening model rejecting one suburb's applicants, drawing an OAIC complaint under the Privacy Act 1988. Undocumented preparation also means that when a result is challenged you cannot reproduce or defend how the data was shaped.
How to implement
Have your data lead write a short data-preparation standard that states, for each step, the criteria for when it applies: for example that records with more than one missing key field are dropped, otherwise the field is imputed with the column median.
The point is that the rule is written down, not decided ad hoc.
For each preparation step, name the actual method rather than a vague intent: spell out the de-duplication key, the normalisation or scaling approach (for example min-max scaling to a 0-1 range), the feature-encoding scheme for categorical fields, and the train/validation/test split ratios.
Whoever prepares data should be able to follow the document without guessing.
Get whoever labels training data to work from a written labelling guideline that defines each label category with examples and sets out how to resolve disagreements between labellers, so the same example is not labelled two different ways.
Ask the person preparing each dataset to record which documented method they actually applied to it, so a prepared dataset can be traced back to a specific version of the standard rather than to memory.
Have the AI management owner approve the standard and re-approve it whenever a data source is added or a method is changed, since a change to a step like normalisation or the split ratio can move model behaviour and should be a deliberate, signed-off decision.
Keep it running
Keep the documented criteria and method list next to the data dictionary so the two stay aligned, and version it whenever you add a new data source or change a step such as the imputation rule for missing values or the train/validation/test split ratio. Record which method was actually used for each dataset (not just the menu of options), so a prepared dataset can be traced back to the documented method that produced it. When you change a preparation method, note why, because a change to normalisation or de-duplication can alter model behaviour and you will want the reason on record.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the documented data-preparation standard or procedure.
Look at
Whether it states the criteria for choosing which preparation steps apply (for example when missing values are imputed versus dropped, when de-duplication runs).
Good evidence
The standard sets out clear, written criteria for selecting preparation steps and is not left to individual judgement.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the list of data-preparation methods the standard names.
Look at
Whether concrete methods are specified: cleaning rules, normalisation or scaling approach, feature encoding, and the train/validation/test split.
Good evidence
Each preparation step names a specific method rather than saying data is cleaned and prepared in general terms.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the labelling or annotation guideline used for training data.
Look at
Whether it defines the label categories and how disagreements between labellers are resolved.
Good evidence
The guideline defines label categories and a documented way to settle inconsistent labels.
- Check 4 of 5What an auditor asks for
Ask for
Ask to see, for one real dataset, the record of which documented methods were applied to it.
Look at
Whether the methods actually used match the documented standard and are traceable to a person and date.
Good evidence
The dataset record maps onto the documented methods and shows who prepared it and when.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the version history of the data-preparation standard.
Look at
Whether it has been updated when a new data source was added or a method changed, with the reason recorded.
Good evidence
The history shows the standard is revised when data sources or methods change, with reasons noted.
Mappings
Closest match in ASD Information Security Manual: ISM-2087, Verify the source and integrity of AI training data, which partially overlaps with this control.
ASD Information Security Manual: 2 mappings
This control partially overlaps ISM-2087.
Annex A 7.6 requires documented criteria for choosing data preparation methods prior to training or operating an AI system. ISM-2087 overlaps because verifying the source and integrity of training data commonly drives which preparation steps are selected (e.g. provenance checks, integrity validation, quarantine/cleaning rules) and should be captured in the Annex A 7.6 selection criteria. ISM-2087 is narrower and targeted to provenance/integrity assurance, whereas Annex A 7.6 covers broader preparation method selection beyond integrity (e.g. formatting, normalisation, labelling strategies).
This control partially overlaps ISM-2088.
Annex A 7.6 requires the organisation to define and document criteria for selecting data preparation steps and methods so data is prepared consistently for AI use. ISM-2088 relates by requiring validation and verification techniques to ensure AI training data is reliable and accurate, which are common data-preparation activities that should be selected and documented under the Annex A 7.6 criteria. ISM-2088 is outcome-focused on accuracy/reliability, while Annex A 7.6 is governance-focused on how preparation methods are chosen and standardised across use cases.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents