Control A.4.5: System and computing resources
As part of identifying resources, record details of the computing and system resources the AI system relies on.
What control A.4.5 asks
As part of identifying resources, record details of the computing and system resources the AI system relies on.
Why it matters for privacy
Where the model runs decides which law applies to the data and who can reach it. A hosted endpoint in another region is a transfer, not a detail.
Where the draft lands: location and tenancy change the risk. Privacy risk follows the data. The abstract does not name a jurisdiction, so the organization has to record where the processing happens.
Basis for A.4.5: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. The lifecycle and where privacy risk enters.
Evidence for control A.4.5
These are the records that turn the control from a statement into something checkable. For control A.4.5 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Resources Computing resource records: requirements, location (on-premises, cloud, edge), processing, network and storage
- Resources Assessment of hardware impacts including environmental and cost
- Resources Resource needs per life cycle stage
Where control A.4.5 commonly fails
- Environmental impact of compute never considered
- Development and production resource needs not distinguished
What to do about control A.4.5 before the draft lands
Record the hosting location, the tenancy model, the encryption and key ownership, and the backup location for each system. Check the transfer position for personal data.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.4.5 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.4.5
- Control A.4.2, Resource documentation
- Control A.4.3, Data resources
- Control A.4.4, Tooling resources
- Control A.6.1.2, Objectives for responsible development of AI system
← Control A.4.4 | Control A.4.6 →
Open the full index. The public record behind control A.4.5 shows the scope and the lifecycle.
Source for control A.4.5: ISO/IEC 42001:2023, Annex A, retrieved 22 October 2026, at the standards library. The overlay rests on the public 27091 record. Every source.