Artificial Intelligence Modelling

The approach you take will depend on the perceived risks and legal requirements that must be fulfilled related to the Artificial Intelligence modeling activity, so without more details, it is not possible to provide a specific answer.

In a general way, I can devise at least two controls that can be applied:

• access control (A.9.1.1 Access control policy): only authorized personnel must have access to data/information, both digitally and physically form
• protection of test data (A.14.3.1 Protection of test data): data in the test must be changed in a way now one can identify the original data from a test sample (i.e., anonymization)

These articles will provide you a further explanation about access control and use test data:

• How to handle access control according to ISO 27001 https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/
• How to set security requirements and test systems according to ISO 27001 https://advisera.com/27001academy/blog/2016/01/11/how-to-set-security-requirements-and-test-systems-according-to-iso-27001/