ISO 42001 Annex A.7.3: Make AI Data Acquisition and Selection Decisions Explicit

What control A.7.3 requires in practice

Control A.7.3 asks the organisation to work out and write down the details of how it acquires and chooses the data used in its AI systems. Two things are being recorded: where the data came from and why this particular material was selected for the intended task. Annex B guidance suggests the details can cover the categories and quantity needed, the kind of source (internal, bought, shared, open or artificially produced), whether the data is fixed or streamed, what is known about the people or items it describes including possible bias, how it was handled before, the rights attached to it, its descriptive metadata and its provenance. These are prompts to consider, not a form every dataset must fill. The output is an acquisition and selection record that lets a reviewer understand the decision and its limits without having to ask the person who made it.

Understand what you are obtaining

Annex B.7.3 considers source types, quantity, characteristics, prior handling, relevant population information, rights, metadata and provenance. Its guidance must be considered under clause 6.1.3(e), while B.1 permits a tailored implementation. These topics help structure the decision without requiring an identical acquisition form for every dataset.

As an original selection test, ask what important condition the proposed data may fail to represent. A convenient source can be incomplete in ways that matter to the use. Documenting the limitation supports a better decision than assuming a large volume eliminates it.

Why control A.7.3 matters to the business

Data that is easy to get is not necessarily data that is right to use. Buying or accepting a dataset without asking about rights, earlier editing and coverage can create legal exposure, wasted development effort and claims about performance that the evidence cannot support. A clear acquisition record helps a business answer a client who asks where the training material came from, and helps its own teams avoid reusing data for a purpose it was never suited to. For auditors, this control shows whether data decisions were made on purpose and whether limitations were admitted openly or buried. The cost of recording is small compared with the cost of unpicking an undocumented source later.

How to implement control A.7.3

Treat each acquisition as a decision with reasons, not as a download. Short, accurate records work better than long forms, and an admitted gap is far more useful to a later reviewer than a confident statement that cannot be supported when someone asks how the material was really obtained.

1. State the task the data must support and what condition or population it needs to represent.
2. List candidate sources and note, for each, how it was collected and handled earlier.
3. Ask the legal or contracts function to confirm the rights and conditions attached to the material before it is accepted.
4. Request what the source can supply: descriptions, labelling details and known limitations. Record anything unavailable.
5. Document what was selected, what was excluded and why, and how the choice limits the claims you can make.
6. Link the record to the quality requirements and provenance entries for the same dataset.
7. Revisit the decision if the source changes how it collects data or the planned use changes.

Illustrative BPO example: a client supplies edited records

Illustrative construction example: purchased images cover different conditions

A construction consultancy purchases labelled project images to support development of a progress-analysis tool. The images come from sites with different materials and camera positions from the planned deployment.

The team examines those characteristics and the rights attached to the supplied material. It documents how the selected data relates to the intended use and where assumptions need evaluation. Access to the files does not itself resolve permission, quality or representativeness questions.

Separate source, selection and use decisions

A source can contain useful material while only part of it is suitable for a particular task. Explain selection criteria and exclusions where they affect the evidence. Conversely, selected data may be suitable for development exploration but insufficient to validate operational performance.

Keep the intended use visible. A dataset acquired for one purpose should not silently become the basis for another use with different requirements. Connect acquisition with quality requirements and provenance.

Address rights and prior handling appropriately

Relevant rights, permissions and contractual conditions need suitable attention. The control does not itself authorise use of publicly accessible or purchased data. Obtain appropriate expertise where obligations are unclear rather than interpret availability as permission.

Prior transformations, labelling or filtering can affect what the data means. Request relevant information and preserve known limitations. If the source cannot supply it, the organisation needs to consider that uncertainty in its decision and claims.

Evidence and common mistakes