ISO 42001 A.4: Resources for AI systems

Data, tooling, compute, human resources documented

By Jorge García Aibar Reviewed 2026-09-19

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-ISO42001-A4. Drawn from chapter 08.

Text alternative

Clause: ISO 42001, A.4.
Duty holder: Not stated.
Applies from: No date, Voluntary.
Artefact: Resource inventory.
Layer: Layer 02 Inventory & Transparency.
Evidence record: AI system register entry.
Record schemas: AI system register entry .
The same topic in 17 other frameworks; the crosswalk section below links each clause.

Id: AIGE-OBL-ISO42001-A4
Instrument: ISO/IEC 42001 standard
Compared side by side: ISO 42001 vs EU AI Act · NIST AI RMF vs ISO 42001
Clause: A.4
Applies from: No date Voluntary · Voluntary management-system standard (2023); no presumption of conformity

The artefact that evidences it

Resource inventory; AIBOM; environment manifests.

L2 Inventory & Transparency

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-ISO42001-A4
Family	Item	Relation
Same crosswalk topic	AI Verify 8.1.1, 8.2.1, 9.12.1, 5.5.1	Core clause
Same crosswalk topic	CSA AICM DSP-20, DSP-21, STA-08, IAM-03	Core clause
Same crosswalk topic	China Algo. Rec. AlgoRec Art. 24	Core clause
Same crosswalk topic	China Deep Synthesis DeepSyn Art. 14, DeepSyn Art. 19	Core clause
Same crosswalk topic	China GenAI Measures GenAI Art. 7, GenAI Art. 8, GenAI Art. 11, GenAI Art. 17	Core clause
Same crosswalk topic	EU AI Act Art. 10, Art. 10(2)(f)–(g), Art. 4a, Art. 53, Art. 53(1)(c), Art. 5(1)(e), Art. 49, Art. 71, Art. 6, Art. 3(1), Art. 52	Core clause
Same crosswalk topic	GAO AI Accountability 2.1, 2.2, 2.4, 2.5, 3.1	Core clause
Same crosswalk topic	GB/T 45654 GB/T 45654 Corpus security	Core clause
Same crosswalk topic	GDPR Art. 5(1)(c), Art. 25, Art. 9	Core clause
Same crosswalk topic	ISO 42001 A.7, A.7.3	Core clause
Same crosswalk topic	NIST AI RMF MAP 2, MEASURE 2.10, MEASURE 2.11, GOVERN 1.6, GOVERN 1.7	Core clause
Same crosswalk topic	Singapore GenAI GenAI 2	Core clause
Same crosswalk topic	TC260 Framework 3.0 TC260 2.1.3, TC260 5.1, TC260 App. 2 II.2, TC260 4.4.1	Core clause
Same crosswalk topic	UK ATRS ATRS 2.4.3, ATRS Tier 1	Core clause
Same crosswalk topic	GPAI Code Copyright 1.1–1.5	Related clause
Same crosswalk topic	Korea AI Act Art. 33	Related clause
Same crosswalk topic	OWASP LLM LLM05:2026	Related clause

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Data governance

EU AI Act Art. 10 Data and data governance (core)
ISO 42001 A.7 Data for AI systems (core)
TC260 Framework 3.0 TC260 2.1.3 Data safety risks (core)
China GenAI Measures GenAI Art. 7 Training-data lawful sourcing (core)
China GenAI Measures GenAI Art. 8 Data-annotation standards (core)
China GenAI Measures GenAI Art. 11 Protection of user input and records (core)
China Deep Synthesis DeepSyn Art. 14 Training-data management (core)
GB/T 45654 GB/T 45654 Corpus security Training-corpus (data) security requirements (core) (clause not verified)
EU AI Act Art. 10(2)(f)–(g) Examination for possible biases; measures to detect, prevent and mitigate them (core)
GDPR Art. 5(1)(c) Data minimisation (core)
GDPR Art. 25 Data protection by design and by default (core)
ISO 42001 A.7.3 Acquisition of data (core) (clause not verified)
CSA AICM DSP-20 Data Provenance and Transparency (core)
UK ATRS ATRS 2.4.3 Development data specification (core)
Singapore GenAI GenAI 2 Data (core)
GAO AI Accountability 2.1 Sources: document sources and origins of data used to develop the models (core)
GAO AI Accountability 2.2 Reliability: assess reliability of data used to develop the models (core)
AI Verify 8.1.1 Data Governance: put in place measures to ensure data quality over time (core)
AI Verify 8.2.1 Data Governance: understand the lineage of data (origin, collection, curation, movement) through a data provenance record (core)
EU AI Act Art. 4a Special-category data for bias detection
NIST AI RMF MAP 2 MAP 2: Categorization of the AI system is performed
NIST AI RMF MEASURE 2.10 MEASURE 2.10: Privacy risk of the AI system is examined and documented
NIST AI RMF MEASURE 2.11 MEASURE 2.11: Fairness and bias are evaluated and results are documented
TC260 Framework 3.0 TC260 5.1 Model R&D safety guidelines
EU AI Act Art. 53 Obligations for providers of general-purpose AI models
EU AI Act Art. 53(1)(c) Copyright policy, including rights reservations
EU AI Act Art. 5(1)(e) Prohibited: untargeted scraping of facial images
GPAI Code Copyright 1.1–1.5 Commitment 1: Copyright policy (Measures 1.1 to 1.5)
GDPR Art. 9 Processing of special categories of personal data
CSA AICM DSP-21 Data Poisoning Prevention & Detection
OWASP LLM LLM05:2026 Data and Model Poisoning
GAO AI Accountability 2.4 Variable selection: assess data variables used in the AI component models
GAO AI Accountability 2.5 Enhancement: assess the use of synthetic, imputed, and/or augmented data

Inventory and registration

EU AI Act Art. 49 Registration (core)
EU AI Act Art. 71 EU database for high-risk AI systems (core)
NIST AI RMF GOVERN 1.6 GOVERN 1.6: Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities (core)
China Algo. Rec. AlgoRec Art. 24 Algorithm filing (core)
China Deep Synthesis DeepSyn Art. 19 Filing for public-opinion services (core)
China GenAI Measures GenAI Art. 17 Algorithm filing (core)
UK ATRS ATRS Tier 1 Summary information (the published record) (core)
AI Verify 9.12.1 Accountability: inventory AI systems and their data, tooling, computing and human resources according to risk priorities (core)
EU AI Act Art. 6 Classification rules for high-risk AI systems
TC260 Framework 3.0 TC260 App. 2 II.2 Identity and access management
TC260 Framework 3.0 TC260 4.4.1 CII registration and filing
EU AI Act Art. 3(1) Definition of an AI system
EU AI Act Art. 52 Procedure
NIST AI RMF GOVERN 1.7 GOVERN 1.7: Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization's trustworthiness
CSA AICM STA-08 Supply Chain Inventory
CSA AICM IAM-03 Identity Inventory
Korea AI Act Art. 33 Confirmation of high-impact AI
GAO AI Accountability 3.1 Documentation: catalog model and non-model components, along with operating specifications and parameters
AI Verify 5.5.1 Security: identify, track and protect AI-related assets (models, data, prompts, logs, assessments)

Source

Chapter 08, section ISO/IEC 42001, 42005 and 42006, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-iso42001-a4.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). ISO 42001 A.4: Resources for AI systems (AIGE-OBL-ISO42001-A4). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a4. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{ISO 42001 A.4: Resources for AI systems (AIGE-OBL-ISO42001-A4)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a4},
  note         = {Version 0.5.0}
}