Requirement
"As part of resource identification, the organization shall document information about the system and computing resources utilized for the AI system."[1]
Explanation
This control covers documenting the infrastructure an AI system runs on — where it is hosted, its processing, network, and storage needs, and the environmental cost of its hardware. Auditors check this record because development, deployment, and operation each carry different resource demands, and undocumented infrastructure hides capacity, location, and sustainability risks.
Implementation Guidance
- Information about system and computing resources for an AI system can include but is not limited to:
- resource requirements of the AI system (i.e. to help ensure the system can run on constrained resource devices);
- where the system and computing resources are located (e.g. on-premises, cloud computing or edge computing);
- processing resources (including network and storage);
- the impact of the hardware used to run the AI system workloads (e.g. the impact to the environment either through use or the manufacturing of the hardware or cost of using the hardware).
- The organization should consider that different resources can be required to allow continual improvement of AI systems. Development, deployment and operation of the system can have different system needs and requirements.
- NOTE: ISO/IEC 22989 describes various system resource considerations.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.4.5
- ISO/IEC 42001:2023 Annex B, B.4.5 (implementation guidance)
