Annex A is an informative example of how to describe data flows and data use for a supervised learning process, using the data use statement approach.
What the base framework establishes
The annex is informative, which means it illustrates rather than requires. The public contents titles it as an example showing how to describe data flows and data use for a supervised learning process, and the base framework's bibliography points to the data flow and data use standard for cloud services as the source of the statement structure. The annex therefore gives a team a model for the description a privacy or data governance review will ask for: where the data comes from, what it is used for, who receives it and what happens to it. The annex text is not in the public sample, so this page describes its documented purpose and does not reproduce its examples.
Why it matters to an AI management system
Data use statements are how a technical pipeline becomes explainable to a privacy officer, a customer or a regulator. The annex shows that the framework expects the description to reach the data, not stop at the model. For a generative system the same structure carries the training data, the prompts and the generated output.
The public draft summary names no change to A Annex A: Example data flow and data use statements. The final text could still touch it.
Evidence a reviewer samples
| Category | Artefact |
|---|---|
| Data flow diagram | Sources, processing, storage, recipients and retention. |
| Data use statement | Each use, its purpose, its basis and the categories of data involved. |
| Generated content note | Where prompts and outputs sit in the flow and how long they are kept. |
One question to prepare for. Can a privacy officer trace a prompt and its output through your system from this description?
Common gaps
- The data flow stops at the model boundary and ignores prompts and outputs.
- The use statement lists purposes but not recipients.
- Retention is described in the privacy notice but not in the system record.
Prepare before publication
Draw the data flow for one system including prompts and outputs, and write a one-page data use statement against it.
Dates that matter
No separate date attaches to A; the record dates are the stage date, the planning estimate and the CEN expectation stated above.
Cross-references
6.4 Data · 8.2 Data acquisition · 8.3 Data preparation
Source
Source for A: ISO/IEC 23053:2022, Annex A (informative). The public sample stops before A, so this page relies on the public contents and the public summary and does not quote the clause. The two official records are linked on this page so any line can be checked.
Not legal advice; does not certify. A reading of the framework and the evidence a reviewer commonly samples, not a substitute for the standard or your auditor's rules.