Requirement
"The organization shall determine and document details about the acquisition and selection of the data used in AI systems."[1]
Explanation
Where AI training and operational data comes from matters as much as what it contains. This control requires documented details of data acquisition and selection — sources, quantities, rights, demographics and prior handling. Auditors check that each AI system's data can be traced back to a recorded acquisition decision.
Implementation Guidance
- The organization can need different categories of data from different sources depending on the scope and use of their AI systems. Details for data acquisition can include:
- categories of data needed for the AI system;
- quantity of data needed;
- data sources (e.g. internal, purchased, shared, open data, synthetic);
- characteristics of the data source (e.g. static, streamed, gathered, machine generated);
- data subject demographics and characteristics (e.g. known or potential biases or other systematic errors);
- prior handling of the data (e.g. previous uses, conformity with privacy and security requirements);
- data rights (e.g. PII, copyright);
- associated meta data (e.g. details of data labelling and enhancing);
- provenance of the data.
- Other information: The data categories and a structure for the data use in ISO/IEC 19944-1 can be used to document details about data acquisition and use.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.7.3
- ISO/IEC 42001:2023 Annex B, B.7.3 (implementation guidance)
