ISO 42001 Clause 7.5.3: Keep AI Information Available and Protected

What clause 7.5.3 requires in practice

Clause 7.5.3 deals with keeping the AI management system's documented information under control. The aim has two sides: the information must be obtainable and fit for purpose at the place and moment of need, and it must be properly safeguarded, for instance from leaks, misuse or damage to its integrity. To achieve this the organisation addresses, as applicable, how information is distributed, accessed, retrieved and used; how it is stored and preserved, including keeping it legible; how changes are controlled, such as through version control; and how long it is retained and how it is disposed of.

A note explains that access may mean permission only to view, or permission to view and change. The clause also reaches outward: documented information of external origin that the organisation considers necessary for planning and operating the system must be identified and controlled as appropriate. No particular platform or permission model is prescribed. The result an auditor looks for is that chosen arrangements actually operate in daily work.

Control the information people actually use

A procedure in an approved repository is of limited value if staff rely on an old downloaded copy. Follow the information to the point of work. Determine how users recognise the current instruction, what they can view or change and how relevant updates reach them.

The standard does not require one particular platform or access model. As an original design test, ask whether an authorised person can retrieve the relevant record after the usual owner is absent. Then ask whether an unauthorised person can alter it without an appropriate decision.

Why clause 7.5.3 matters to the business

Information that exists but cannot be found, or that anyone can quietly alter, offers little protection in a dispute. Staff may follow an outdated copy, a departed colleague's files may be unreachable, and sensitive assessment findings may spread further than intended. Each of those has a business cost, from rework to client complaints to exposure of confidential material. Supplier guidance is a quieter risk: if the supplier changes its terms of use and nobody notices, your own controls may rest on assumptions that are no longer true. Good control lets the business answer questions about past decisions promptly, while keeping sensitive material restricted to those who need it.

How to implement clause 7.5.3

Design control around how people actually reach and change information. A sensible route, which Sterling teams often follow, is to start with the three or four record types that matter most and work outwards.

1. List the information types in scope and classify each by sensitivity and by who needs to read it or change it.
2. Set access so that viewing and changing are separate permissions, and test that an authorised deputy can retrieve a record when its owner is absent.
3. Make the current version obvious at the point of use, and remove or mark superseded copies that staff might still rely on.
4. Define how corrections to completed records are made, so a factual fix does not erase the original account.
5. Decide retention and disposal using legal obligations, evidence purpose and sensitivity, record by record, rather than one blanket rule.
6. Identify the external sources you depend on and assign an owner to notice and assess changes in them.
7. Run a retrieval test on an old assessment and a supplier notice, and correct whatever slows or blocks it.

Illustrative BPO example: sensitive assessment findings

Illustrative manufacturing example: an external instruction changes

A manufacturer relies on an AI inspection supplier's guidance about supported product variants. The supplier updates its online material. The local instruction still refers to an earlier version, and staff cannot tell whether the current guidance affects their line.

The manufacturer identifies the external information needed for operation, establishes how changes are recognised and determines their local effect. It preserves appropriate evidence of the basis for earlier decisions. Merely bookmarking a webpage does not ensure that changes are understood or that historical assumptions can be reconstructed.

Preserve meaning across storage and change

Availability involves more than keeping a file. Records should remain readable and understandable for the needed period, including when software or personnel change. Links, attachments and version references may be necessary to interpret an assessment result.

Changes to operating information should be controlled, while evidence of completed decisions needs protection against inappropriate alteration. The arrangement can distinguish correcting a factual error from overwriting the historical account. Explain how authorised corrections remain understandable.

Set retention and disposal deliberately

The clause requires attention to retention and disposal but does not prescribe one number of years for all AIMS information. Determine periods using applicable obligations, the evidence purpose and organisational needs. Different records may justify different arrangements.

Indefinite retention is not automatically the most responsible choice, particularly for sensitive information. Conversely, deleting earlier assessments whenever a new one is produced can conflict with requirements to retain all assessment results. Check the relevant source requirement before simplifying a record set.

Evidence and common failures