← All themesOpen in explorer →
Data Governance across ISO 42001, NIST AI RMF and the EU AI Act
// theme · data-governance
Data Governance
Training/validation/test data quality, bias, provenance, representativeness.
// Do once → satisfies all three
ONE dataset datasheet per training/validation/test set - source, licence, consent, representativeness, bias check, drift baseline.
Art.10 prescribes the substance; ISO A.7 demands the controls; NIST MAP/MEASURE want the evidence. A single datasheet is the artefact that proves all three.
ISO 42001
Annex A.7
NIST AI RMF
MAP 2.3 · MEASURE 2.10 · MEASURE 2.11
EU AI Act
Art.10
// Evidence auditors expect
- ✓ Dataset datasheet / data card (source, licence, consent, date)
- ✓ Bias and representativeness analysis per protected attribute
- ✓ Data-quality metrics (completeness, duplicates, label noise)
- ✓ PII inventory + lawful basis for training data
// Common pitfalls
- ⚠ Assuming 'we bought the data so it's fine' - EU Art.10 demands representativeness and bias examination regardless of source.
- ⚠ No record of training-data lineage when a regulator asks 12 months later.
- ⚠ Bias check only at launch, never re-run after retraining.
ISO 42001
6Annex A.7 + A.4 require controls over data acquisition, quality and the resources used to train and run AI.
Annex A.4.3
Data resources
Document the data resources used by AI systems across the lifecycle.
Annex A.7.2
Data for development and enhancement
Manage the data used to develop and enhance AI systems across the lifecycle.
Annex A.7.3
Acquisition of data
Control how data is acquired for AI systems, including sourcing and legal basis.
Annex A.7.4
Quality of data
Manage the quality of data used by AI systems, including accuracy, completeness and bias.
Annex A.7.5
Data provenance
Track the provenance of data used for AI systems so origin and changes are known.
Annex A.7.6
Data preparation
Manage the preparation of data (cleaning, labelling, transformation) used for AI systems.
NIST AI RMF
3MAP 2.3 and MEASURE 2.10/2.11 cover representativeness, privacy, bias and fairness as measurable outcomes.
MAP 2.3
Scientific integrity and TEVV
Scientific integrity and Test, Evaluation, Verification & Validation considerations documented.
MEASURE 2.10
Privacy risk examined
Privacy risk of the AI system examined and documented.
MEASURE 2.11
Fairness & bias evaluated
AI system is evaluated for fairness and harmful bias.
EU AI Act
1Art.10 is prescriptive: training, validation and test data must be relevant, representative, free of errors and complete, with bias examined.