Data Provenance

Every dataset has a history: it was collected somewhere, possibly edited multiple times, merged with other data, and eventually used to train a model. Data provenance means recording this history in full. It documents the origin of the data, every processing step, and every actor who touched the data. The goal is traceability: anyone who later discovers a problem can trace the path backward and find the source of the issue — much like a supply chain in industry that knows the manufacturer of every single screw. Without this documentation, a dataset is like an anonymous file without a stamp or signature.

Why flawed provenance ruins models

AI models learn exclusively from the data they are given. If this data is biased, incorrect, or unlawfully collected, the model inherits these flaws. A model trained on texts from a particular source will favor that source’s perspective — even if this was never intended.

Without data provenance, this problem often goes unnoticed. You don’t know where the data came from, and therefore cannot judge whether it was representative. Only once the model produces incorrect or discriminatory results does the error become visible — but by then it is hard to pinpoint. With clean documentation, on the other hand, the error can be traced back to a specific dataset and fixed in a targeted way.

Legal questions add to this. In the European Union, the General Data Protection Regulation requires that personal data only be used with permission. Anyone who has not documented where their training data came from cannot prove, in a dispute, that they had this permission. Data provenance is therefore not just a technical quality marker but also a legal safeguard.

How provenance is technically captured

In practice, metadata is stored: information about the data itself. This includes the source (e.g., a website or a database), the time of collection, who collected it, and which processing steps have occurred since. Every change — removing duplicates, translating texts, anonymizing names — is logged as a separate step.

For large AI projects, standardized formats for these logs now exist. A well-known concept is so-called Datasheets for Datasets: structured documents in which the creators of a dataset record the purpose for which the data was collected, who was authorized to collect it, and what known limitations it has. These documents accompany the dataset like a package insert.

A more technically elaborate variant uses so-called graph databases, which store every step of data processing as a node in a network. This creates a complete, machine-readable family tree of the data. Tools such as Apache Atlas or OpenLineage specialize in exactly this purpose.

Data provenance in current AI debates

Since large language models such as GPT or Gemini have been publicly discussed, data provenance has been at the center of several disputes. Publishers, authors, and news agencies are suing AI companies because their texts were used as training data without permission. The companies are often unable to fully prove which content, in what form, flowed into their models — a direct result of missing provenance documentation.

The EU AI Act, the world’s first comprehensive AI law, which has been taking effect in stages since 2024, requires providers of so-called high-risk AI systems to provide detailed documentation of their training data. Anyone unable to produce this documentation may not market their system in the EU. Data provenance has thus turned from a voluntary best practice into a legal obligation.

The topic is also gaining importance in the corporate world. Banks and insurers use AI models for credit decisions or risk assessments. If a model there produces an incorrect result, those responsible must be able to explain how it came about — and this is only possible if the origin and processing of the data are fully documented.