ISO 42001 A.7: Data for AI systems

Data quality, provenance, preparation

By Jorge García Aibar Reviewed 2026-09-19

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-ISO42001-A7. Drawn from chapter 08.

Text alternative

Clause: ISO 42001, A.7.
Duty holder: Not stated.
Applies from: No date, Voluntary.
Artefact: Data cards.
Layers: Layer 02, Layer 03.
Evidence record: Dataset admission record, +1 more.
Record schemas: Dataset admission record , Dataset card .
The same topic in 18 other frameworks; the crosswalk section below links each clause.

Id: AIGE-OBL-ISO42001-A7
Instrument: ISO/IEC 42001 standard
Compared side by side: ISO 42001 vs EU AI Act · NIST AI RMF vs ISO 42001
Clause: A.7
Applies from: No date Voluntary · Voluntary management-system standard (2023); no presumption of conformity

The artefact that evidences it

Data cards; lineage; data quality tests.

Patterns that build it

Training-Data Rights Ledger (layer 2)
Dataset Admission Gate (layer 1 and 2)
Rights Requests Against Models (layer 2 and 5)

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Data governance

EU AI Act Art. 10 Data and data governance (core)
TC260 Framework 3.0 TC260 2.1.3 Data safety risks (core)
China GenAI Measures GenAI Art. 7 Training-data lawful sourcing (core)
China GenAI Measures GenAI Art. 8 Data-annotation standards (core)
China GenAI Measures GenAI Art. 11 Protection of user input and records (core)
China Deep Synthesis DeepSyn Art. 14 Training-data management (core)
GB/T 45654 GB/T 45654 Corpus security Training-corpus (data) security requirements (core) (clause not verified)
EU AI Act Art. 10(2)(f)–(g) Examination for possible biases; measures to detect, prevent and mitigate them (core)
GDPR Art. 5(1)(c) Data minimisation (core)
GDPR Art. 25 Data protection by design and by default (core)
CSA AICM DSP-20 Data Provenance and Transparency (core)
UK ATRS ATRS 2.4.3 Development data specification (core)
Singapore GenAI GenAI 2 Data (core)
GAO AI Accountability 2.1 Sources: document sources and origins of data used to develop the models (core)
GAO AI Accountability 2.2 Reliability: assess reliability of data used to develop the models (core)
EU AI Act Art. 4a Special-category data for bias detection
ISO 42001 A.4 Resources for AI systems
NIST AI RMF MAP 2 MAP 2: Categorization of the AI system is performed
NIST AI RMF MEASURE 2.10 MEASURE 2.10: Privacy risk of the AI system is examined and documented
NIST AI RMF MEASURE 2.11 MEASURE 2.11: Fairness and bias are evaluated and results are documented
TC260 Framework 3.0 TC260 5.1 Model R&D safety guidelines
EU AI Act Art. 53 Obligations for providers of general-purpose AI models
EU AI Act Art. 53(1)(c) Copyright policy, including rights reservations
EU AI Act Art. 5(1)(e) Prohibited: untargeted scraping of facial images
GPAI Code Copyright 1.1–1.5 Commitment 1: Copyright policy (Measures 1.1 to 1.5)
GDPR Art. 9 Processing of special categories of personal data
CSA AICM DSP-21 Data Poisoning Prevention & Detection
OWASP LLM LLM05:2026 Data and Model Poisoning
GAO AI Accountability 2.4 Variable selection: assess data variables used in the AI component models
GAO AI Accountability 2.5 Enhancement: assess the use of synthetic, imputed, and/or augmented data

Privacy and data protection

GDPR Art. 5 Principles relating to processing of personal data (core)
GDPR Art. 6 Lawfulness of processing (core)
GDPR Art. 25 Data protection by design and by default (core)
NIST AI RMF MEASURE 2.10 MEASURE 2.10: Privacy risk of the AI system as identified in the MAP function is examined and documented (core)
CSA AICM DSP-08 Data Privacy by Design and Default (core)
OWASP LLM LLM02:2026 Sensitive Information Disclosure (core)
CoE Convention CoE Art. 11 Privacy and personal data protection (core)
China GenAI Measures GenAI Art. 7(3) Consent or another lawful basis for personal information in training data (core)
China GenAI Measures GenAI Art. 11 Protection of user input and records (core)
GAO AI Accountability 2.8 Security and privacy: assess data security and privacy for the AI system (core)
EU AI Act Art. 59 Further processing of personal data in the AI regulatory sandbox
EU AI Act Art. 4a Special-category data for bias detection
GDPR Art. 35 Data protection impact assessment
CSA AICM DSP-22 Privacy Enhancing Technologies
UK DUAA UK GDPR Art. 22B Restrictions on automated decision-making
Singapore GenAI GenAI 2 Data
OECD AI Principles OECD 1.2 Rule of law, human rights and democratic values, including fairness and privacy
G7 Code G7 Action 11 Implement data input measures and protect personal data and intellectual property

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-DATA-001 Dataset Admission Gate at Read Time (Data admission and privacy profile)
AIGE-CTL-DATA-002 Dataset Card for Every Admitted Version (Data admission and privacy profile)
AIGE-CTL-DATA-008 Fitness-for-Purpose Checks Before Admission (Data admission and privacy profile)
AIGE-CTL-DATA-010 Lineage from Training Runs to Admitted Sources (Data admission and privacy profile)

Source

Chapter 08, section ISO/IEC 42001, 42005 and 42006, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-iso42001-a7.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). ISO 42001 A.7: Data for AI systems (AIGE-OBL-ISO42001-A7). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a7. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{ISO 42001 A.7: Data for AI systems (AIGE-OBL-ISO42001-A7)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a7},
  note         = {Version 0.5.0}
}