What an auditor, or Sekit's evidence engine, asks for.
AI dataset record: provenance, permitted use and quality
For each dataset an AI system uses, the record of where it came from, what the company is allowed to do with it (licence, consent, restrictions), whether it contains personal data, and the quality and preparation checks run before using it (cleaning, labelling, data split).
From the Sekit evidence catalog
In practice
For most readers this means checking whether data pasted into a vendor chatbot, or documents uploaded into a vendor assistant's knowledge base, ends up training or improving that vendor's model; the vendor's terms of service settle it, and few teams ever read that clause before using the tool. If you build or fine-tune your own model, the same governance applies to your training data: a consultancy tuning on client case files needs the client contract to permit that use, not merely convenient access. An auditor asks for the AI dataset record and checks whether anyone reviewed the permitted-use terms, vendor or in-house, before the data went in.
Common gaps
Staff paste client case files into a vendor chatbot to draft a summary, and nobody checks whether the vendor's terms let that data train its model.
If you fine-tune your own model, a common miss is training it on historical support tickets collected for service delivery, without checking whether the original consent basis covers AI training.
If you fine-tune in house, data minimization stops at general company records and is never extended to the extra copy pulled out for that training job.
Questions your auditor will ask
Does data you paste or upload into a vendor AI tool ever feed its training?
The AI dataset record notes each vendor's permitted-use terms; check the vendor's terms of service and data processing agreement before assuming customer data stays out of training.
Were you allowed to use this data for AI training?
The record captures the permitted use, checked against the original licence, consent or contract before the dataset was used, not assumed after the fact.
If you train or tune your own model, how do you know the data was good enough?
Quality and preparation checks, cleaning, labelling, and the data split, are logged in the AI dataset record for each dataset that fed the system.
Is personal data included in the data feeding any of your AI tools?
The AI dataset record flags personal data per dataset, covering data sent into a vendor tool as well as data used to train or tune your own model, tied back to the wider data inventory rather than checked separately.
Where regulation demands it
GDPR's records of processing (30.1) extend to data repurposed for AI training; using a dataset for a new purpose without recording it breaks that record.
NIS2 art. 12.4 (Asset inventory) is meant to cover every data asset, including the copies pulled together specifically to build or tune an AI system.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.