Control · C-069 · Data & Data Governance
Dataset documentation
Each dataset used for AI has a maintained record of its source, collection method, contents, rights, lawful basis, known limitations and permitted uses.
- Control type
- Directive
- Family
- Risks addressed
- 7
- Audience
- Heads-of · Practitioner
- Frameworks
- Principle 8 · Article 10 · AML.M0025
- Responsible AI domain
- Lifecycle stage
- Reviewed
- 2026-11-11
What it does
It makes a dataset understandable to people who did not assemble it. A standard record, kept with the data, states what it contains, where it came from, whose data it includes, what it may and may not be used for, and what is known to be wrong with it. The data owner is accountable for the record. It is created when a dataset is first prepared for AI use and updated at every material change.
How to implement it
- Adopt a standard template, such as a datasheet, scaled to the dataset's importance.
- Record source, collection method, time period, population covered and labelling process.
- Record rights, licence, lawful basis and the purposes the data may be used for.
- Record known gaps, biases and quality results.
- Record which models and systems use the dataset.
- Version the record with the data and review it on a set cycle.
Evidence it operates
Design: a documentation standard and template. Operation: a current record for each dataset in use; version history matching changes to the data; records referred to in validation and in impact assessments; links from the inventory.
Where it fits
Alongside the data throughout its life. With lawful basis review it is a primary control for unlawful or undocumented training data basis, and it supports purpose creep in AI data use and unfulfillable data subject rights by recording what data is where. It supplies the data section of model and system documentation.
Limits
A record is only as accurate as its last update, and data changes more often than documents. It describes what its authors knew. For bought datasets and pre-trained models the detail is often unavailable, and the record should say so plainly. Documentation makes misuse recognisable and does nothing to prevent it. Where a dataset is copied and adapted by several teams, each copy needs its own record or the original soon describes nothing in use.
Risks this mitigates
Primary mappings
- Training data transparency gap Medium
- Records what each dataset contains and where it came from. The organisation cannot say what data a model was trained on, to the level regulators, customers or rights holders require.
- Unlawful or undocumented training data basis High
- Records source, rights and permitted uses for each dataset. Personal data is used to train, fine-tune or ground an AI system with no documented lawful basis, or beyond what the basis relied on allows.
Supporting mappings
- Copyright infringement in training data High
- Records the rights position of each dataset. A model is trained or fine-tuned on protected works without a licence or an applicable exception, by the organisation or by a provider whose model it uses.
- Inadequate technical documentation Medium
- Supplies the data documentation. Design, data, testing and limitations are not documented well enough for a validator, auditor or regulator to understand the system.
- Poor quality or unrepresentative training data High
- Records known limitations of each dataset. Training or reference data is inaccurate, incomplete, out of date or unrepresentative of the population the system serves, and the model inherits the defect.
- Purpose creep in AI data use Medium
- Records the permitted uses of each dataset. Data collected for one purpose is used to train or run AI for another purpose that the people concerned would not expect.
- Unfulfillable data subject rights High
- Knowing what data is where makes the request answerable. Requests for access, rectification, erasure or objection cannot be met because personal data sits inside a model, or in stores that nobody can search.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Code of Practice for the Cyber Security of AI | Principle 8 | Document your data, models and prompts Documentation of data. |
| EU AI Act | Article 10 | Data and data governance Records of data origin and preparation. |
| MITRE ATLAS | AML.M0025 | Maintain AI Dataset Provenance Dataset provenance. |
Related terms
How to cite
Axiom Verity (2026). Dataset documentation. Reference Library, C-069. https://axiom-verity.com/controls/dataset-documentation. Reviewed 2026-11-11.
Found an error or a better source? Report a correction.