Requirement
"The organization shall identify and document relevant resources required for the activities at given AI system life cycle stages and other AI-related activities relevant for the organization."[1]
Explanation
This control asks the organization to keep a documented inventory of everything each AI system depends on — data, tools, hardware, and people — across its life cycle. Auditors look for this documentation because it underpins risk and impact assessments: an organization cannot understand what can go wrong without knowing what the system is built from.
Implementation Guidance
- Documentation of resources of the AI system is critical for understanding risks, as well as potential AI system impacts (both positive and negative) to individuals or groups of individuals, or both, and societies. The documentation of such resources (which can utilize, for instance, data flow diagrams or system architecture diagrams) can inform the AI system impact assessments (see B.5).
- Resources can include, but are not limited to:
- AI system components;
- data resources, i.e. data used at any stage in the AI system life cycle;
- tooling resources (e.g. AI algorithms, models or tools);
- system and computing resources (e.g. hardware to develop and run AI models, storage for data and tooling resources);
- human resources, i.e. people with the necessary expertise (e.g. for the development, sales, training, operation and maintenance of the AI system) in relation to the organization's role throughout the AI system life cycle.
- Resources can be provided by the organization itself, by its customers or by third parties.
- Other information: Documentation of resources can also help to determine if resources are available and, if they are not available, the organization should revise the design specification of the AI system or its deployment requirements.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.4.2
- ISO/IEC 42001:2023 Annex B, B.4.2 (implementation guidance)
