{"slug":"data-governance-and-dataset-documentation","id":"AIPT-CTL-0012","title":"Data governance and dataset documentation","kind":"process","kind_label":"Process","purpose":"Makes sure the data used to train, tune, validate and test an AI system is fit for purpose, understood and documented, so that quality and bias problems are found in the data before they surface in decisions.\n","description":"Each dataset used in building a system gets a documentation sheet describing where it came from, how it was collected and labelled, what it is meant to represent, known gaps and the cleaning and transformation steps applied. Data owners check representativeness against the intended population and run bias and quality checks before a dataset is approved for use. Access, retention and change control apply to datasets in the same way as to code, and the documentation is versioned alongside the model that consumed it. Deployers who supply their own input data apply a lighter version of the same checks to confirm relevance.\n","owner_role":"Data governance lead","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["1.1","1.3","7.3","2.1"],"evidence":[{"type":"dataset_documentation","title":"Dataset documentation sheet","description":"Provenance, collection, labelling, representativeness, limitations and preparation steps for one dataset."},{"type":"evaluation_report","title":"Data quality and bias check report","description":null},{"type":"approval_record","title":"Dataset approval for use","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.7.2, A.7.3, A.7.4, A.7.6","note":null,"confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 2.3; MEASURE 2.1, 2.2, 2.11","note":null,"confidence_level":"medium"},{"framework":"mitre_atlas","framework_name":"MITRE ATLAS","reference":"AML.M0007 Sanitize Training Data","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM04 Data and Model Poisoning","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-data-governance","title":"Apply data governance and quality criteria to training, validation and testing data","relationship":"satisfies","note":"Dataset documentation, representativeness and bias checks per dataset.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-data-governance"},{"slug":"eu-ai-act-technical-documentation","title":"Draw up technical documentation before placing a high-risk system on the market","relationship":"supports","note":"Dataset sheets supply the data sections.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation"},{"slug":"eu-ai-act-art-26-4-deployer-input-data","title":"Deployers must ensure input data they control is relevant and representative","relationship":"satisfies","note":"Applied to operational input data rather than training data.","confidence_level":"medium","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data"},{"slug":"uk-principles-fairness","title":"Use AI in ways that are fair and do not discriminate unlawfully","relationship":"supports","note":"Bias checks on training data.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-fairness"},{"slug":"india-dpdp-consent-and-notice","title":"Process personal data only with valid consent or a legitimate use, after notice","relationship":"supports","note":"Dataset documentation records consent status per source.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice"},{"slug":"singapore-mgf-operations-management","title":"Manage data quality, model development and monitoring across the lifecycle","relationship":"satisfies","note":"Data lineage and dataset bias minimisation.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-operations-management"},{"slug":"singapore-pdpc-consent-or-exception-for-ai-data","title":"Identify consent or an applicable PDPA exception before using personal data in AI","relationship":"supports","note":"Dataset sheets record the legal basis alongside provenance.","confidence_level":"medium","is_binding":true,"policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data"},{"slug":"us-new-york-city-local-law-144-data-policy-disclosure","title":"Employers and employment agencies must disclose the data collected and their retention policy for the tool","relationship":"supports","note":"Source of the data inventory disclosed.","confidence_level":"medium","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure"}],"related_controls":["training-data-provenance-and-copyright-register","technical-documentation-and-model-cards","privacy-and-data-protection-for-ai","accuracy-robustness-security-testing"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation","context_url":"https://aipolicytracker.org/controls/data-governance-and-dataset-documentation.md"}