Requirement
"As part of resource identification, the organization shall document information about the data resources utilized for the AI system."[1]
Explanation
Every AI system stands on its data, so the organization must document where that data comes from, how it is categorized, labelled, and prepared, its quality, retention rules, and known bias issues. Auditors use this record to judge whether the organization actually understands the data feeding its models.
Implementation Guidance
- Documentation on data should include, but is not limited to, the following topics:
- the provenance of the data;
- the date that the data were last updated or modified (e.g. date tag in metadata);
- for machine learning, the categories of data (e.g. training, validation, test and production data);
- categories of data (e.g. as defined in ISO/IEC 19944-1);
- process for labelling data;
- intended use of the data;
- quality of data (e.g. as described in the ISO/IEC 5259 series);
- applicable data retention and disposal policies;
- known or potential bias issues in the data;
- data preparation.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.4.3
- ISO/IEC 42001:2023 Annex B, B.4.3 (implementation guidance)
