Data Preparation
Write down how your organisation decides which data-preparation steps to apply and which methods to use, so data is shaped consistently before it trains or feeds an AI system.
Plain language
Before raw data can be used by an AI system, it usually needs work: removing errors, filling gaps, putting values on a common scale, and labelling examples. This control says you must write down the rules for which of these preparation steps you apply and which methods you use, rather than leaving it to whoever happens to be doing the job that week. Data preparation here means the tidying and shaping of data (for example cleaning, de-duplication, normalising values to a common range, and splitting data into training and testing sets) done before a model learns from it.
Framework
ISO/IEC 42001:2023
Control effect
Preventative
Classifications
N/A
Official last update
01 Dec 2023
Control Stack last updated
19 June 2026
Official control statement
The organisation shall define and document its criteria for selecting data preparations and the data preparation methods to be used.
Why it matters
If nobody has written down the criteria and methods, two people preparing the same dataset will make different choices (one drops rows with missing values, another fills them with a guessed average) and the model's behaviour shifts without anyone knowing why. Mislabelled or unbalanced training data can bake in a bias that later surfaces as, for example, a loan-screening model rejecting one suburb's applicants, drawing an OAIC complaint under the Privacy Act 1988. Undocumented preparation also means that when a result is challenged you cannot reproduce or defend how the data was shaped.
Operational notes
Keep the documented criteria and method list next to the data dictionary so the two stay aligned, and version it whenever you add a new data source or change a step such as the imputation rule for missing values or the train/validation/test split ratio. Record which method was actually used for each dataset (not just the menu of options), so a prepared dataset can be traced back to the documented method that produced it. When you change a preparation method, note why, because a change to normalisation or de-duplication can alter model behaviour and you will want the reason on record.
Implementation tips
- Have your data lead write a short data-preparation standard that states, for each step, the criteria for when it applies: for example that records with more than one missing key field are dropped, otherwise the field is imputed with the column median. The point is that the rule is written down, not decided ad hoc.
- For each preparation step, name the actual method rather than a vague intent: spell out the de-duplication key, the normalisation or scaling approach (for example min-max scaling to a 0-1 range), the feature-encoding scheme for categorical fields, and the train/validation/test split ratios. Whoever prepares data should be able to follow the document without guessing.
- Get whoever labels training data to work from a written labelling guideline that defines each label category with examples and sets out how to resolve disagreements between labellers, so the same example is not labelled two different ways.
- Askthe person preparing each dataset to record which documented method they actually applied to it, so a prepared dataset can be traced back to a specific version of the standard rather than to memory
- Have the AI management owner approve the standard and re-approve it whenever a data source is added or a method is changed, since a change to a step like normalisation or the split ratio can move model behaviour and should be a deliberate, signed-off decision.
Audit / evidence tips
- AskAsk for the documented data-preparation standard or procedure.GoodThe standard sets out clear, written criteria for selecting preparation steps and is not left to individual judgement.
- AskAsk for the list of data-preparation methods the standard names.GoodEach preparation step names a specific method rather than saying data is cleaned and prepared in general terms.
- AskAsk for the labelling or annotation guideline used for training data.GoodThe guideline defines label categories and a documented way to settle inconsistent labels.
- AskAsk to see, for one real dataset, the record of which documented methods were applied to it.GoodThe dataset record maps onto the documented methods and shows who prepared it and when.
- AskAsk for the version history of the data-preparation standard.GoodThe history shows the standard is revised when data sources or methods change, with reasons noted.
Cross-framework mappings
How Annex A 7.6 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
handshakeSupports(2)expand_less | ||
| Annex A 5.12 | Annex A 7.6 requires organisations to document criteria and methods for preparing data used by AI systems | |
| Annex A 5.37 | Annex A 7.6 requires the organisation to define and document criteria for selecting data preparations and the data preparation methods us... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 42001 controls in A.7 Data for AI systems
See all A.7 Data for AI systems controls, or browse the full ISO 42001 Annex A library.
Want to implement this AI control?
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.