Control A.7.5: Data provenance
Set out a documented way of keeping a record of where data used in AI systems come from and how they change, over the life of both the data and the system.
What control A.7.5 asks
Set out a documented way of keeping a record of where data used in AI systems come from and how they change, over the life of both the data and the system.
Why it matters for privacy
Provenance is what lets you answer a subject request, withdraw a dataset or prove a lawful basis years later. Without it, the only answer is that the data is in the model.
Where the draft lands: traceability of personal data. The draft's treatment of risk needs traceability. Provenance is the record that makes deletion, correction and withdrawal possible.
Basis for A.7.5: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. Treating the risk: data and third parties.
Evidence for control A.7.5
These are the records that turn the control from a statement into something checkable. For control A.7.5 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- Data provenance Provenance records covering creation, update, transcription, abstraction, validation, transfer of control, sharing and transformation
- Data provenance Decision on whether provenance verification measures are needed
Where control A.7.5 commonly fails
- Provenance lost after data transformations
- No verification for third-party data
What to do about control A.7.5 before the draft lands
Record the lineage of each dataset and each model version: source, collection date, transformations, the people included and the retention. Keep it queryable.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.7.5 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.7.5
- Control A.7.2, Data for development and enhancement of AI system
- Control A.7.3, Acquisition of data
- Control A.7.4, Quality of data for AI systems
- Control A.7.6, Data preparation
← Control A.7.4 | Control A.7.6 →
Open the full index. The public record behind control A.7.5 shows the scope and the lifecycle.
The record behind control A.7.5 is the ISO/IEC 42001:2023 Annex A set, retrieved 22 October 2026. The public 27091 abstract supplies the privacy direction, not a draft requirement. Check the sources.