04.2 Resource documentation

The organisation shall identify and document relevant resources required for the activities at given AI system life cycle stages and other AI-related activities relevant for the organisation. This control is essential for maintaining governance and ensuring that AI systems are managed responsibly. It should be applied consistently across all relevant organisational processes and reviewed periodically to remain effective.

Business Requirement The purpose of this control is to safeguard organisational integrity, compliance with legal and regulatory requirements, and to promote trustworthiness in AI systems. It ensures that risks are mitigated and that the organisation’s objectives for responsible AI use are achieved.

Documentation of resources of the AI system is critical for understanding risks, as well as potential AI system impacts (both positive and negative) to individuals or groups of individuals, or both, and societies. The documentation of such resources (which can utilise, for instance, data flow diagrams or system architecture diagrams) can inform the AI system impact assessments (see B.5). Resources can include, but are not limited to: — AI system components; — data resources, i.e. data used at any stage in the AI system life cycle; — tooling resources (e.g. AI algorithms, models or tools); — system and computing resources (e.g. hardware to develop and run AI models, storage for data and tooling resources); — human resources, i.e. people with the necessary expertise (e.g. for the development, sales, training, operation and maintenance of the AI system) in relation to the organisation’s role throughout the AI system life cycle. Resources can be provided by the organisation itself, by its customers or by third parties. Organisations should implement this control by establishing clear procedures, assigning responsibilities, and maintaining accurate documentation. Practical steps include integrating this control into existing governance frameworks, training relevant personnel, and monitoring compliance through regular audits.