Control A.4.2: Resource documentation
Identify and document the resources needed for the activities at each relevant AI life cycle stage and for other AI-related activities of the organization.
What control A.4.2 asks
Identify and document the resources needed for the activities at each relevant AI life cycle stage and for other AI-related activities of the organization.
Why it matters for privacy
You cannot assess a privacy risk in a resource you have not documented. The data, the tooling, the compute and the people are the four places personal data can appear without a decision.
Where the draft lands: the lifecycle register starts with resources. The abstract asks for risks to be identified throughout the lifecycle. A resource record is the inventory that makes the lifecycle traceable.
Basis for A.4.2: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. The lifecycle and where privacy risk enters.
Evidence for control A.4.2
These are the records that turn the control from a statement into something checkable. For control A.4.2 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Resources Resource inventory per AI system and life cycle stage (components, data, tooling, computing, people)
- Resources Data flow or architecture diagrams
- Resources Record of resources provided by customers or third parties
Where control A.4.2 commonly fails
- Resource inventory covers infrastructure only
- Third-party provided resources not identified
What to do about control A.4.2 before the draft lands
Write the resource record for each system: the data sources, the tooling and versions, the compute and hosting location, and the people with access. Mark which resource touches personal data.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.4.2 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.4.2
- Control A.4.3, Data resources
- Control A.4.4, Tooling resources
- Control A.4.5, System and computing resources
- Control A.6.1.2, Objectives for responsible development of AI system
← Control A.3.3 | Control A.4.3 →
Open the full index. The public record behind control A.4.2 shows the scope and the lifecycle.
Control A.4.2 is cited to ISO/IEC 42001:2023, Annex A. The requirement, evidence and gaps are our wording from the control record; the privacy overlay is read from the ISO page and its abstract. The full list.