Requirement
"The organization shall define and document a process for recording the provenance of data used in its AI systems over the life cycles of the data and the AI system."[1]
Explanation
Data provenance means knowing where each dataset came from and what has happened to it — creation, updates, transformations, transfers of control. Auditors expect a documented process that records this history across the life of both the data and the AI system, so questionable data can be identified and traced.
Implementation Guidance
- According to ISO 8000-2, a record of data provenance can include information about the creation, update, transcription, abstraction, validation and transferring of the control of data. Additionally, data sharing (without transfer of control) and data transformations can be considered under data provenance. Depending on factors such as the source of the data, its content and the context of its use, organizations should consider whether measures to verify the provenance of the data are needed.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.7.5
- ISO/IEC 42001:2023 Annex B, B.7.5 (implementation guidance)
