Data provenance

Data provenance, closely related to data lineage, answers the questions any reviewer of an AI system will ask: what is this data, who produced it, are we allowed to use it, and what happened to it on the way? Good provenance records the source and collection method, licences, contracts or lawful basis, consent conditions where relevant, dates, versions, filtering, labelling and the pipelines that combined datasets.

The EU AI Act requires data governance practices for high-risk systems that cover data collection processes and the origin of data, and, for personal data, the original purpose of collection. Data protection law requires the controller to know which lawful basis covers reuse for training. Provenance also matters for copyright, for synthetic data mixed with real data, and for audits, where lineage records are core evidence. The ISO/IEC 5259 series addresses data quality for analytics and machine learning.

Example: an auditor traces a model's training set back to a scraped forum and asks the provider to show that the terms of use allowed it.