Control A.4.6: Human resources
As part of identifying resources, record the people and competences used for building, deploying, running, changing, maintaining, transferring and retiring the AI system and for integrating and verifying it.
What control A.4.6 asks
As part of identifying resources, record the people and competences used for building, deploying, running, changing, maintaining, transferring and retiring the AI system and for integrating and verifying it.
Why it matters for privacy
The competency of the people who label, review and operate the system is a privacy control. An annotator who can see special category data needs to know what not to copy.
Where the draft lands: the people in the lifecycle. The abstract applies to all organizations that build AI systems or use them, which puts the people who handle the data inside the scope of the assessment.
Basis for A.4.6: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Scope, role and who answers.
Evidence for control A.4.6
This is the evidence an auditor or a privacy reviewer asks to see. For control A.4.6 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Resources Staffing and competence records per life cycle activity
- Resources Evidence diverse expertise was considered (data science, human oversight, safety, security, privacy, domain experts)
Where control A.4.6 commonly fails
- No competence recorded for decommissioning or transfer
- Human oversight roles not resourced
What to do about control A.4.6 before the draft lands
Record who works on each system, their role, their access and the training they completed. Include annotators, reviewers and the staff who use the output.
The requirement for control A.4.6 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.4.6
- Control A.2.2, AI policy
- Control A.2.3, Alignment with other organizational policies
- Control A.3.2, AI roles and responsibilities
- Control A.10.2, Allocating responsibilities
← Control A.4.5 | Control A.5.2 →
Open the full index. The public record behind control A.4.6 shows the scope and the lifecycle.
Control A.4.6 is cited to ISO/IEC 42001:2023, Annex A. The requirement, evidence and gaps are our wording from the control record; the privacy overlay is read from the ISO page and its abstract. The full list.