ISO 42001 AI Data Controls: Acquisition, Quality, Provenance and Preparation

Illustrative software example: support data with misleading signals

A software company develops an AI feature that classifies incoming support requests. It has several years of historical tickets and initially assumes that volume makes the dataset valuable. Examination shows that labels changed after a process redesign, some customer groups used different support channels and closed tickets do not always indicate a correctly resolved issue.

The team separates the decisions. Acquisition and permission are reviewed through the relevant internal and contractual routes. Quality requirements consider the intended classification task and the meaning of the labels. Provenance records the origin and relevant changes in the data. Preparation decisions document how incompatible label periods or incomplete records are handled, with evaluation used to examine the consequences of those choices.

The resulting dataset may be smaller but more defensible for the intended task. The team does not assume that removing inconvenient cases improves quality; some difficult cases may be important to the real use. It examines whether preparation has hidden a problem or altered the population the system is expected to serve.

Define quality in relation to purpose

A.7.4 concerns defined and documented data-quality requirements and ensuring relevant data meets them. Quality may involve characteristics such as accuracy, completeness, integrity, relevance or representativeness, depending on context. The useful question is what a shortcoming means for the system and affected parties, not whether a generic quality checklist has every box marked.

Consider operational data as well as development data. A system evaluated on one input distribution may encounter another in service. Changes in collection methods, users, locations or equipment can alter suitability. Connect data-quality findings with evaluation and monitoring rather than assuming that a dataset approved during development remains representative forever.

Where thresholds or acceptance criteria are used, explain their basis and response. A number without a decision rule creates the appearance of control while leaving staff uncertain about action. Some issues may be addressed through preparation; others may require additional data, changed requirements or a narrower use. Do not treat technical cleaning as a cure for every data limitation.

Illustrative construction example: images from different projects

A construction organisation evaluates AI-assisted analysis of project photographs. Images from an earlier project are readily available, but the proposed use involves different building stages, capture practices and environmental conditions. The team needs to understand whether the available data supports the new task rather than merely whether the image files can be processed.

Provenance records help identify the project context and relevant transformations. Quality criteria address the characteristics needed for the intended analysis. Preparation choices may include selecting or labelling material, but the organisation examines how those choices affect coverage. If only the clearest images remain, evaluation may no longer reflect the difficult conditions users will encounter.

The organisation retains an explainable connection between source information, prepared data and evaluation results. This helps reviewers understand a limitation and decide whether further evidence is needed before the new use. The example concerns AI data governance; it does not establish a method for accepting construction work or replace competent project judgement.

Make provenance and preparation reconstructable

Provenance supports understanding of data history across relevant data and system life-cycle activities. It can include creation, updates, transformations, validation, transfer or sharing, depending on context. The record should allow the organisation to answer questions that matter, such as which source or transformation contributed to an observed issue. A provenance label with no usable supporting information offers little value.

Preparation requires defined and documented selection criteria and methods. Explain why the selected approach fits the task and what it changes. Annex B gives examples of preparation activities, but the organisation is not required to perform every example on every dataset. The choice should follow the data, purpose and relevant evidence.

Retain enough information to evaluate the effect of preparation. A change to labelling, missing-value handling or selection may affect outcomes even when the underlying model is unchanged. Connect those changes to the appropriate review and evaluation. Reproducibility and traceability needs should be proportionate to the use and risks, with suitable controls over sensitive information.

Evidence and common weaknesses

Useful evidence can include acquisition decisions, quality requirements and results, provenance records, preparation criteria and links to evaluation. These may exist across established technical and management records. A dedicated “AI data dossier” is one possible method, not a prescribed ISO document title.

Common weaknesses include confusing availability with permission, assuming quantity proves quality, applying one quality standard to every data role and documenting preparation without its rationale. Another is keeping a record of the original data while losing the link to the version actually used. Review one consequential output or evaluation result and ask whether the relevant data decisions can be explained.

Use the delivery controls to connect data with requirements and evaluation, and supplier controls where data comes from external parties. The Annex A overview explains how those themes contribute to risk treatment.

Review the data decisions behind one AI use

Discuss an AI data-governance assessment with Sterling, tracing one dataset from acquisition through preparation and evaluation. Scope practical documentation and control support, including an agreed role for Effivity ISO & GRC automation software. AI Risk & Impact Assessment helps teams examine the consequences of data limitations, while Documented Information Management supports a clearer approach to maintaining the records those decisions need.

Individual controls in this theme

Why AI data controls matter to the business

AI systems learn from, or are judged by, the data they are given, so weak data decisions travel into every output. The five data controls in this group give a business a way to separate questions that are easily blurred: what data was obtained, whether it is good enough, where it came from, how it was altered and how the whole process is managed. For a client, the practical benefit is confidence that a surprising result can be traced to a cause. For an auditor, the group is a test of whether data was treated as a governed asset rather than a convenient input. Organisations that handle customer or employee information through suppliers have the most to gain, because their data history is often the least visible part of the chain.