Control A.4.3: Data resources
Within resource identification, document information about the data resources the AI system uses.
What control A.4.3 asks
Within resource identification, document information about the data resources the AI system uses.
Why it matters for privacy
A data resource entry that says 'customer data' tells an assessor nothing. The privacy question is which fields, which people, which purpose and which lawful basis.
Where the draft lands: data is where the privacy risk begins. The abstract is about privacy risk in AI systems. The data resource is the first place that risk becomes specific and testable.
Basis for A.4.3: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. The lifecycle and where privacy risk enters.
Evidence for control A.4.3
This is the evidence an auditor or a privacy reviewer asks to see. For control A.4.3 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Resources Data resource records covering provenance, last update date, ML data categories, labelling process, intended use, quality, retention and disposal, known bias and preparation
Where control A.4.3 commonly fails
- Known bias in datasets undocumented
- No record of when data were last updated
What to do about control A.4.3 before the draft lands
For each data resource, record the categories of personal data, the number of people, the source, the purpose, the retention and the lawful basis. Flag special category data separately.
The requirement for control A.4.3 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.4.3
- Control A.4.2, Resource documentation
- Control A.4.4, Tooling resources
- Control A.4.5, System and computing resources
- Control A.6.1.2, Objectives for responsible development of AI system
← Control A.4.2 | Control A.4.4 →
Open the full index. The public record behind control A.4.3 shows the scope and the lifecycle.
The record behind control A.4.3 is the ISO/IEC 42001:2023 Annex A set, retrieved 22 October 2026. The public 27091 abstract supplies the privacy direction, not a draft requirement. Check the sources.