Requirement
"The organization shall define, document and implement data management processes related to the development of AI systems."[1]
Explanation
Data management is the foundation of trustworthy AI: this control asks for defined, documented and implemented processes governing the data used to develop and improve AI systems. An auditor will expect a written process covering concerns such as privacy, security, transparency, representativeness and accuracy — not ad hoc handling by individual teams.
Implementation Guidance
- Data management can include various topics such as, but not limited to:
- privacy and security implications due to the use of data, some of which can be sensitive in nature;
- security and safety threats that can arise from data dependent AI system development;
- transparency and explainability aspects including data provenance and the ability to provide an explanation of how data are used for determining an AI system's output if the system requires transparency and explainability;
- representativeness of training data compared to operational domain of use;
- accuracy and integrity of the data.
- NOTE: Detailed information of AI system life cycle and data management concepts is provided by ISO/IEC 22989.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.7.2
- ISO/IEC 42001:2023 Annex B, B.7.2 (implementation guidance)
