Resources for AI Systems - ISO 42001 Annex A Controls
ISO 42001 Annex A.4
You cannot manage what you cannot see. Annex A.4 is the inventory discipline that makes the rest of the management system possible.
ISO 42001 Annex A.4 - Resources for AI Systems Explained
Annex A.4 is the inventory layer of the AI management system. The objective is to make sure the organisation accounts for the resources of its AI systems so that risks and impacts can be fully understood and addressed.
Control A.4.2 - Resource documentation
The organisation must identify and document relevant resources required for the activities at given AI system life cycle stages and other AI-related activities. The resources include AI system components, data, tooling, system and computing resources, and human resources. Documentation can take the form of data flow diagrams, system architecture diagrams, or structured registers depending on the organisation's needs.
Control A.4.3 - Data resources
The organisation must document information about the data resources used by AI systems. The implementation guidance under Annex B.4.3 specifies the kinds of information typically needed - the provenance of the data, the date the data were last updated, the categories of data (training, validation, test, production), the labelling process, the intended use, the quality, the applicable retention and disposal policies, known or potential bias issues, and data preparation methods.
Control A.4.4 - Tooling resources
The organisation must document the tooling resources used by AI systems. Tooling resources can include the algorithm types and machine learning models, data conditioning tools, optimisation methods, evaluation methods, provisioning tools, and software and hardware for AI system design, development and deployment.
Control A.4.5 - System and computing resources
The organisation must document the system and computing resources used by AI systems. This typically includes resource requirements, the location of the resources (on-premises, cloud, edge), processing resources including network and storage, and the impact of the hardware used to run AI workloads, including environmental impact.
Control A.4.6 - Human resources
The organisation must document information about the human resources and their competences used across the AI system life cycle. The list of typical human resources in Annex B.4.6 includes data scientists, roles related to human oversight, experts on trustworthiness topics such as safety, security and privacy, AI researchers and specialists, and domain experts. The organisation should consider the need for diverse expertise across the life cycle.
The AI Process Register approach
The most efficient way to satisfy Annex A.4 in practice is through an AI Process Register that captures, for each AI system within scope, the data sources and characteristics, the tooling and platforms used, the system and computing environment, the human resources involved, and the controls applied. The register is the operational hub of the AI management system and connects directly to the risk assessment, the impact assessment, the Statement of Applicability and the supplier records.
The level of detail in resource documentation should be proportionate to the risk and complexity of the AI system. A high-impact AI system used in regulated decision-making warrants detailed documentation across all five sub-controls. A low-impact internal AI tool can be documented more lightly. The Statement of Applicability should reflect the level of detail proportionate to each AI system.
For AI deployers using third-party AI services, much of the technical documentation required by A.4.3, A.4.4 and A.4.5 comes from the supplier. The deployer documents what the supplier has shared and what the deployer has chosen to use, rather than reverse-engineering the supplier's systems.
When auditing Annex A.4, I sample AI systems from the AI Process Register and trace through to the resource documentation for each. I want to see data resources, tooling resources, system and computing resources and human resources documented at a level that supports the risk and impact assessments.
For deployer-only organisations, I expect the documentation to be lighter on the technical details that come from suppliers, and to rely on supplier documentation for those elements. The organisation must still record what is in use and the responsible owner for each resource.
Our AI Process Register has separate sections for each AI system. For the inspection AI, we document the training data the supplier provided as a description, the model version we are running, the on-premises hardware it runs on, and the QA team that operates it. For the generative tool, we document the categories of inputs allowed, the platform used, the cloud region and the people authorised to use it. Two systems, two profiles.
Practical Compliance Guidance
The AI Process Register is the central document for satisfying Annex A.4, with each AI system within scope captured in a structured row that records the resources, the controls applied and the responsible owner. The IMS1 Manual Section 1.4 Processes/IMS1-1-4 Interaction of Processes provides the overarching context for how AI processes fit into the management system.
The following alphaZ documents support compliance with ISO 42001 Annex A.4.
| alphaZ document | How to use it |
|---|---|
| ISO 42001 AI Management System Toolkit | The full toolkit containing the AI management system documentation including the AI Process Register and the supporting registers for resources. |
| F-IMS40 AI Process Register | Records the AI systems within scope and the resources used by each, supporting compliance with all five Annex A.4 controls. |
| F-Q112 AI Data Matrix | Records the data resources used by each AI system including provenance, categories, quality, retention and bias considerations, supporting A.4.3. |
| F-Q111 AI System Lifecycle | Records the AI system life cycle stages and the resources used at each stage, supporting A.4.2 and the wider Annex A.6 life cycle controls. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
Do we need separate registers for each type of resource?
No. A single AI Process Register that captures all five resource types per AI system is usually more efficient than separate registers. Some organisations use supporting documents (data matrix, life cycle log, computing environment record) referenced from the main register.
For deployers using third-party AI, how detailed does resource documentation need to be?
The level of detail should be proportionate to the risk and to what the supplier provides. Deployers document what they know and use, and reference supplier documentation for technical details under the supplier's control. For high-impact AI systems, deployers should request more detail from suppliers. For low-impact systems, lighter documentation is acceptable.
Do all five A.4 controls have to be implemented?
The controls are reference controls, included or excluded based on the risk assessment. In practice all five are difficult to exclude because they form an integrated inventory, but the depth of implementation can vary. The Statement of Applicability records the inclusion decision and any partial application.