Control A.7.2: Data for development and enhancement of AI system
Set up, write down and operate processes for managing the data used to develop AI systems.
What control A.7.2 asks
Set up, write down and operate processes for managing the data used to develop AI systems.
Why it matters for privacy
Data requirements written for performance produce models that use more personal data than the purpose needs. The privacy requirement has to be written at the same time.
Where the draft lands: data requirements are treatment. The abstract says the guidance establishes mechanisms to treat privacy risk. The first treatment is the decision not to collect a field.
Basis for A.7.2: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. Treating the risk: data and third parties.
Evidence for control A.7.2
These are the records that turn the control from a statement into something checkable. For control A.7.2 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Data management Data management process for AI development covering privacy and security implications, data-related security and safety threats, transparency and provenance, representativeness of training data and data accuracy and integrity
Where control A.7.2 commonly fails
- Representativeness of training data against the domain of use not checked
- Sensitive data used without privacy review
What to do about control A.7.2 before the draft lands
Define the data needed for the purpose, the fields that are prohibited, the quality threshold and the minimisation test. Document the decision for each field.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.7.2 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.7.2
- Control A.7.3, Acquisition of data
- Control A.7.4, Quality of data for AI systems
- Control A.7.5, Data provenance
- Control A.7.6, Data preparation
← Control A.6.2.8 | Control A.7.3 →
Open the full index. The public record behind control A.7.2 shows the scope and the lifecycle.
Read control A.7.2 against ISO/IEC 42001:2023, Annex A, at the standards library. The overlay is ours, from the public record; nothing here is the draft text. Every source.