04.5 System and computing resources

As part of resource identification, the organisation shall document information about the system and computing resources utilised for the AI system. This control is essential for maintaining governance and ensuring that AI systems are managed responsibly. It should be applied consistently across all relevant organisational processes and reviewed periodically to remain effective.

Business Requirement The purpose of this control is to safeguard organisational integrity, compliance with legal and regulatory requirements, and to promote trustworthiness in AI systems. It ensures that risks are mitigated and that the organisation’s objectives for responsible AI use are achieved.

Information about system and computing resources for an AI system can include but is not limited to: — resource requirements of the AI system (i.e. to help ensure the system can run on constrained resource devices); — where the system and computing resources are located (e.g. on-premises, cloud computing or edge computing); — processing resources (including network and storage); — the impact of the hardware used to run the AI system workloads (e.g. the impact to the environment either through use or the manufacturing of the hardware or cost of using the hardware). The organisation should consider that different resources can be required to allow continual improvement of AI systems. Development, deployment and operation of the system can have different system needs and requirements. NOTE ISO/IEC 22989 describes various system resource considerations. Organisations should implement this control by establishing clear procedures, assigning responsibilities, and maintaining accurate documentation. Practical steps include integrating this control into existing governance frameworks, training relevant personnel, and monitoring compliance through regular audits.