# Data governance and dataset documentation

- **Record type**: Control
- **Kind**: Process
- **Owner**: Data governance lead
- **Frequency**: Once per AI system
- **Duties served**: 8

## What the control achieves

Makes sure the data used to train, tune, validate and test an AI system is fit for purpose, understood and documented, so that quality and bias problems are found in the data before they surface in decisions.

## How it is typically implemented

Each dataset used in building a system gets a documentation sheet describing where it came from, how it was collected and labelled, what it is meant to represent, known gaps and the cleaning and transformation steps applied. Data owners check representativeness against the intended population and run bias and quality checks before a dataset is approved for use. Access, retention and change control apply to datasets in the same way as to code, and the documentation is versioned alongside the model that consumed it. Deployers who supply their own input data apply a lighter version of the same checks to confirm relevance.

## Evidence it produces

- Dataset documentation sheet (dataset_documentation): Provenance, collection, labelling, representativeness, limitations and preparation steps for one dataset.
- Data quality and bias check report (evaluation_report)
- Dataset approval for use (approval_record)

## Legal duties this control serves

- Apply data governance and quality criteria to training, validation and testing data — EU AI Act, European Union (satisfies): https://aipolicytracker.org/obligations/eu-ai-act-data-governance
- Draw up technical documentation before placing a high-risk system on the market — EU AI Act, European Union (supports): https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation
- Deployers must ensure input data they control is relevant and representative — EU AI Act, European Union (satisfies): https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data
- Process personal data only with valid consent or a legitimate use, after notice — India DPDP Act, India (supports): https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice
- Manage data quality, model development and monitoring across the lifecycle — Singapore Model AI Governance Framework, Singapore (satisfies): https://aipolicytracker.org/obligations/singapore-mgf-operations-management
- Identify consent or an applicable PDPA exception before using personal data in AI — PDPC AI advisory guidelines, Singapore (supports): https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data
- Use AI in ways that are fair and do not discriminate unlawfully — UK AI regulation framework, United Kingdom (supports): https://aipolicytracker.org/obligations/uk-principles-fairness
- Employers and employment agencies must disclose the data collected and their retention policy for the tool — NYC Local Law 144 (automated employment decision tools), New York (United States) (supports): https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure

## Standards clauses it corresponds to (clause numbers only)

- ISO/IEC 42001:2023: Annex A.7.2, A.7.3, A.7.4, A.7.6
- NIST AI RMF 1.0: MAP 2.3; MEASURE 2.1, 2.2, 2.11
- MITRE ATLAS: AML.M0007 Sanitize Training Data
- OWASP Top 10 for LLM Applications: LLM04 Data and Model Poisoning

## MIT AI Risk Repository subdomains addressed

1.1, 1.3, 7.3, 2.1

## Provenance

- **Record page**: https://aipolicytracker.org/controls/data-governance-and-dataset-documentation
- **Official source**: none recorded — this record is incomplete, see https://aipolicytracker.org/gaps
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-09-24
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.