Data & Information ยท DAT-08
Provenance of training and test data
For data used to train, tune or test AI, the organisation knows and records where it came from, what rights it holds over it, and any limits on its use.
Why it matters
Data of unknown origin can carry rights the organisation does not hold, biases nobody can trace, or restrictions that surface only after release. A recorded provenance lets these questions be answered, and lets a model be rebuilt or withdrawn if a source turns out to be unusable.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Training and test data are gathered from wherever is convenient, and their origin is not recorded. |
| 2 Developing | Origin is recorded for some data sets, but rights, licences and limits are not consistently checked. |
| 3 Defined | For every data set used to train, tune or test AI, origin, rights, limits and preparation are recorded before use and linked to the models that used it. |
| 4 Managed | Provenance records are checked for completeness before release, and when a source's rights or limits change, affected models are identified and acted on. |
| 5 Optimising | Provenance is captured automatically through data pipelines, and the approach is refined from audits, disputes and changes in rights or regulation. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- DAT-08.1 For every data set used to train, tune or test AI, the source, collection method, rights, licence terms and use limits are recorded before use.
- DAT-08.2 Each such data set is linked to the models that used it.
- DAT-08.3 The preparation and labelling steps applied to each such data set are recorded.
- DAT-08.4 Synthetic and augmented data are labelled as such, with a record of how they were generated and how their fitness was checked.
Assessment questions
- For a model you train or tune, which data was used and where did each set come from?
- What rights do you hold over that data, and what limits apply to its use?
- If a source had to be withdrawn, could you identify every model that used it?
- Provenance records for training and test data sets
- Licence or rights documentation for externally sourced data
- Links between data sets and the models or versions that used them
- Preparation, labelling and synthetic data records
How to reach Level 3
- Before any data set is used to train, tune or test AI, record its source, collection method, rights, licence terms and use limits.
- Record the preparation and labelling steps applied to each data set.
- Label synthetic and augmented data as such, and record how it was generated and how its fitness was checked.
- Link each data set record to the models that used it, for example through the bill of materials (TEC-07).
Common pitfalls
- Assuming data found online is free to use for training.
- Recording provenance but not linking it to models, so the effect of a rights problem cannot be traced.
Starter artefacts
- Data provenance record template
- Data set to model link register
Cross-references
| AI Cyber Security Code of Practice | 2.3 partial; 5.2 partial; 8.1 partial; 8.2 direct |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Model specification direct; Tier 2 Development data specification direct |
| EU AI Act | Art 10 partial |
| ISO/IEC 42001 | A.4.3 partial; A.7.2 partial; A.7.3 direct; A.7.5 direct; A.7.6 direct |
| JSP 936 Part 1 | para 113 partial; para 158 partial; para 161 direct; para 162 partial; para 202 direct |
| MITRE AI Maturity Model | P1.2 partial; P5.3 partial |
| NIST AI 600-1 | R4 partial; R10 direct; R11 partial; R12 direct |
| NIST AI RMF 1.0 | GOVERN 6.1 partial; MAP 2.3 partial; MAP 4.1 partial |
| UK Data and AI Ethics Framework | Transparency 6 direct; Transparency 9 partial; Privacy 6 partial; SAT 3.5 direct |
| UNESCO AI Maturity Framework | 6.1 partial; 6.2 direct; 6.4 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.