Control A.7.2 – Data for Development and Enhancement of AI Systems

In today’s article by Kimova AI, we explore Annex A Control A.7.2 – Data for Development and Enhancement of AI Systems, a key control in ISO/IEC 42001 that focuses on how organizations manage data specifically used to build, train, test, retrain, and improve AI systems over time.

As an ISMS and AI governance auditor, one recurring theme is clear: most AI risks originate not from algorithms, but from the data used during development and enhancement. This control ensures that data-driven improvements do not compromise fairness, security, compliance, or trust.

What This Control Means

Control A.7.2 requires organizations to implement defined processes to ensure that data used for development, training, testing, validation, and ongoing enhancement of AI systems is appropriate, lawful, and responsibly managed.

This includes data that is:

newly collected,
reused from previous models,
sourced from third parties, or
generated through operational feedback loops.

The organization must ensure that data used to enhance AI systems does not unintentionally introduce new risks or amplify existing ones.

Why This Control Is Critical

AI systems evolve. Models are retrained, refined, and adapted as business needs change. Without proper controls, this evolution can lead to:

increased bias or unfair outcomes
model drift and degraded performance
use of unauthorized or low-quality data
regulatory and contractual violations
loss of explainability and traceability

ISO 42001 addresses this by requiring governance over how enhancement data is selected, evaluated, and approved.

Key Requirements Under Control A.7.2

To comply with this control, organizations should ensure:

Data Suitability for Development – Data used for training or retraining must align with the AI system’s intended purpose and defined requirements.
Data Quality and Representativeness – Datasets should be assessed for accuracy, completeness, relevance, and representativeness to avoid skewed or biased outputs.
Legal and Ethical Compliance – Data usage must comply with data protection laws, licensing terms, and ethical commitments.
Change Impact Awareness – Enhancement data should be evaluated for its potential impact on model behavior, fairness, and risk levels.
Documentation and Traceability – All datasets used for development and enhancement must be documented, including their origin, purpose, and limitations.
Secure Handling of Development Data – Development and enhancement datasets must be protected against unauthorized access or tampering.

Implementation Guidance

Organizations can implement Control A.7.2 effectively by:

Defining clear criteria for accepting development and enhancement data
Conducting bias and impact assessments before retraining models
Maintaining dataset version control and linkage to model versions
Requiring formal approval before using new data for enhancement
Reviewing enhancement outcomes against performance and ethical benchmarks
Aligning development data governance with ISMS and privacy frameworks
Ensuring cross-functional oversight involving technical, legal, and compliance teams

At Kimova AI, we help organizations structure AI development pipelines that ensure data-driven improvements remain controlled, compliant, and auditable.

Conclusion

Annex A Control A.7.2 reinforces that AI enhancement must be intentional, transparent, and governed. By controlling the data used to develop and improve AI systems, organizations protect themselves from unintended risks while enabling safe innovation.

In tomorrow’s article by Kimova.AI, we’ll explore Annex A Control A.7.3 – Acquisition of Data, where we’ll explore how organizations can source, collect, and obtain data for AI systems in a lawful, ethical, and controlled manner while ensuring data quality, security, and compliance.

Try Ask AIMS for Free