A.4 Resources for AI Systems: Compute, Data, Tooling and People

Control A.4 requires that your organisation allocates adequate resources to operate your AI management system. Resources include compute infrastructure, data, tools and people. This is not a vague “sufficient resources” requirement. It is a requirement to define what resources your AI systems need and to ensure that you have provided them. This lesson explains what auditors look for and how to evidence resource adequacy.

Defining resource needs

The first step is to identify what resources your AI systems need. Compute resources include processors, memory, storage and networking for model training, validation and deployment. Data resources include the volume and quality of training data needed, the cost of data cleaning, and storage costs.

Tooling includes frameworks for model development, tools for data management, bias testing platforms and monitoring systems. People resources include data engineers, ML engineers, AI security specialists and domain experts who understand your business well enough to validate model outputs.

For each AI system you operate, you should document its resource requirements. These might be listed in a resource plan that is reviewed when the system is deployed and revisited during operation. This plan does not need to be a detailed budget, but it should state what types of resources are needed and whether they are available internally or purchased from vendors.

Allocating resources for the management system itself

Control A.4 also requires that you allocate resources specifically to operate your AI management system. This means someone must spend time maintaining your control register, reviewing policies, coordinating risk assessments and planning internal audits. In many organisations, this is part of the CISO or compliance team’s responsibility.

If no one has time allocated to AI governance, it will not happen. Auditors often see audit findings that state “controls are not evidenced because no one was assigned to maintain them”. To avoid this, define who owns the AI management system as a process, how many hours per week or month they spend on it, and what their key activities are.

Assessing whether resources are adequate

Control A.4 requires that you assess whether allocated resources are sufficient. This assessment should be documented. Some signs that resources are inadequate include falling behind on risk assessments, unable to complete audits on schedule, or AI projects requesting exemptions from controls because they claim “not enough time”.

Resources might also be inadequate if you lack expertise. If no one on your team understands how to conduct a bias test but you have deployed a model that could affect hiring decisions, this is a resource gap. Your response might be to hire someone, to outsource testing to a third party, or to redesign the model to reduce bias risk.

Recording resource allocation

Many organisations maintain a resource allocation matrix or table. For each AI system, this records what infrastructure is allocated, what data sources are approved, what tools are available and who has responsibility for using those tools. During audit, if an auditor asks “why was this AI system not tested for fairness” and you respond “we do not have the tools”, the auditor will check whether you documented this resource gap and what steps you took to address it.