Control A.4.4: Tooling resources
Within resource identification, document information about the tooling resources the AI system uses.
What control A.4.4 asks
Within resource identification, document information about the tooling resources the AI system uses.
Why it matters for privacy
Tooling decides what is logged, what is retained and what leaves the organization. A default setting in a framework can keep every prompt for a year.
Where the draft lands: tooling defaults are privacy decisions. The lifecycle in the abstract includes development and operation. Tooling is where a default silently becomes the retention policy.
Basis for A.4.4: the ISO page 56582 and the ISO/IEC 42001:2023 control record. No draft requirement is stated here: the abstract gives the direction and the text is not public. The lifecycle and where privacy risk enters.
Evidence for control A.4.4
The list below is what a reviewer will want produced, not described. For control A.4.4 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Resources Tooling inventory listing algorithm types and models, data conditioning tools, optimization and evaluation methods, provisioning tools, model development aids and design, development and deployment software and hardware
Where control A.4.4 commonly fails
- Open-source libraries and model hubs missing from the inventory
What to do about control A.4.4 before the draft lands
Record the tooling and version for each system, the telemetry and logging defaults, the retention setting and the data residency. Review the defaults before the next deployment.
Do not rebuild around a draft. Control A.4.4 already requires the evidence above, and the privacy preparation is the same control applied to the personal data an AI system touches.
Read across from control A.4.4
- Control A.4.2, Resource documentation
- Control A.4.3, Data resources
- Control A.4.5, System and computing resources
- Control A.6.1.2, Objectives for responsible development of AI system
← Control A.4.3 | Control A.4.5 →
Open the full index. The public record behind control A.4.4 shows the scope and the lifecycle.
Read control A.4.4 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.