ISO 42001: 2023 - A.4.2 Resource Documentation

ISO 42001 Control Description

The organisation shall identify and document relevant resources required for the activities at given AI system life cycle stages and other AI-related activities relevant for the organisation.

Control Objective

To ensure that the organisation accounts for the resources (including AI system components and assets) of the AI system in order to fully understand and address risks and impacts.

Purpose

To provide a comprehensive inventory of all resources needed for AI systems throughout their lifecycle. Documenting resources is critical for understanding AI-related risks, assessing potential impacts on individuals and societies, enabling resource planning, and informing AI system impact assessments.

Guidance on Implementation

Resources to Document

The organisation should identify and document:

1. AI system components - Functional elements that comprise the AI system
2. Data resources - Data used at any stage in the AI system lifecycle (see Control A.4.3 for details)
3. Tooling resources - AI algorithms, models, development tools (see Control A.4.4 for details)
4. System and computing resources - Hardware, storage, processing capacity (see Control A.4.5 for details)
5. Human resources - People with necessary expertise throughout the lifecycle (see Control A.4.6 for details)

Lifecycle Stage Coverage

Document resources required for activities at each applicable AI system lifecycle stage (ISO/IEC 5338):

• Inception - Feasibility assessment, initial planning
• Design and development - Architecture, data preparation, model training, testing
• Verification and validation - Testing infrastructure, validation datasets, expert reviewers
• Deployment - Production infrastructure, integration resources
• Operation and monitoring - Ongoing compute resources, monitoring tools, operational personnel
• Continuous validation - Drift detection tools, retraining resources
• Re-evaluation - Periodic review resources, assessment personnel
• Retirement - Decommissioning resources, data archival/deletion

Resource Sources

Document whether resources are:

• Provided by the organisation itself
• Provided by customers (e.g., customer data for model training)
• Provided by third parties (e.g., cloud services, third-party models, external datasets)

For third-party resources, document supplier information and contractual arrangements.

Documentation Methods

The organisation can utilise various methods to document resources:

1. a) Resource inventory - Comprehensive list of all resources with categorisation
2. b) Data flow diagrams - Showing how data moves through the AI system
3. c) System architecture diagrams - Illustrating components and their relationships
4. d) Dependency maps - Showing relationships between resources
5. e) Lifecycle stage matrices - Mapping resources to specific lifecycle stages

What to Document for Each Resource

For each identified resource, document:

• Resource identifier - Unique ID or name
• Resource type - Category (data, tooling, computing, human, component)
• Description - Purpose and function
• Lifecycle stages - Where in the lifecycle it's used
• Source - Internal, customer-provided, or third-party
• Owner/custodian - Who is responsible
• Dependencies - Related or dependent resources
• Availability - Current status (available, planned, unavailable)
• Risk considerations - Known risks associated with the resource

Implementation Steps

Organisations should:

1. Conduct resource assessment - For each AI system or AI-related activity, systematically identify all required resources across the lifecycle
2. Categorise resources - Group into the five main categories (components, data, tooling, computing, human)
3. Create documentation - Use appropriate format (inventory list, diagrams, matrices) suitable for organisational needs
4. Link to impact assessments - Ensure resource documentation feeds into AI system impact assessments (see Annex B.5 and Control A.5.2)
5. Assess resource availability - Determine if resources are available; if not, revise design specifications or deployment requirements accordingly
6. Maintain and update - Keep resource documentation current as AI systems evolve, resources change, or new systems are developed
7. Make accessible - Ensure documentation is available to relevant stakeholders (developers, risk managers, auditors, impact assessors)

Key Considerations

Integration with impact assessment: Resource documentation directly informs AI system impact assessments (ISO/IEC 42005 Clause 6.6). The documentation helps identify potential impacts based on resource characteristics (e.g., data biases, computational limitations, human expertise gaps).

Resource adequacy: Documentation helps identify whether necessary resources are available. If critical resources are missing or inadequate, the organisation should address this before proceeding with AI system development or deployment.

Lifecycle variability: Resource needs often differ significantly across lifecycle stages. Development requires different resources than operation. Document these variations explicitly.

Third-party dependencies: Carefully document third-party resources as these introduce supply chain risks. Include information about supplier reliability, data sovereignty, contractual terms, and contingency plans.

Granularity: The level of detail in resource documentation should be proportionate to the risk level of the AI system. High-risk systems require more detailed documentation.

Living documentation: Resource documentation is not a one-time activity. It should be updated when resources change, new dependencies are introduced, or lifecycle activities evolve.

Related Controls

Within ISO/IEC 42001:

• A.4.3 Data resources
• A.4.4 Tooling resources
• A.4.5 System and computing resources
• A.4.6 Human resources
• A.5.2 AI system impact assessment process
• Clause 7.1 Resources

Related Standards:

• ISO/IEC 5338 AI system lifecycle processes
• ISO/IEC 42005 AI system impact assessment