What an auditor, or Sekit's evidence engine, asks for.
AI dataset record: provenance, permitted use and quality
For each dataset an AI system uses, the record of where it came from, what the company is allowed to do with it (licence, consent, restrictions), whether it contains personal data, and the quality and preparation checks run before using it (cleaning, labelling, data split).
From the Sekit evidence catalog
In practice
This control applies only if your company trains or fine-tunes its own model, not if you use a vendor's AI tool as-is. For a company that does build in house, preparation covers everything done to raw data before it trains or tunes a model: cleaning, labelling, augmenting, splitting into training and test sets. Each step should be reproducible and reviewed, not a one-off script run once and deleted. An auditor asks how a dataset was cleaned and labelled, and whether the training and test split was documented. The AI dataset record should show these preparation steps per dataset. A common gap is labelling done by an outside contractor with no record of instructions, leaving no way to check for bias.
Common gaps
For a company training its own model, cleaning and labelling scripts run once during the project and are never saved, so preparation can't be reproduced later.
In a fine-tuning project, a contractor labels training data with no documented instructions, leaving no way to check for bias introduced at that step.
When a company trains its own model, the training and test split is never recorded, so results cannot be reproduced or trusted later.
Questions your auditor will ask
If you train or fine-tune a model in house, how was that data cleaned and labelled?
The dataset record documents preparation steps per dataset, cleaning, labelling and the training and test split, for anyone building or tuning their own model.
If a contractor labels data for your model, were their instructions documented?
Labelling instructions are recorded alongside the dataset for any in-house build, whether done by staff or a contractor, so bias or error at that step can be checked.
Is your data inventory reviewed on a schedule, or only when someone remembers?
The data inventory review cycle runs on a fixed schedule, flagging datasets that no longer have a purpose, including prepared AI training sets.
If you train your own model, can you reproduce the training and test split used?
The split is documented per dataset in the record for any in-house build, so validation results can be checked against the same split rather than a new random one.
Where regulation demands it
GDPR's processing records (30.1) extend to prepared data, not only raw data: cleaning and labelling personal data is still processing that needs recording.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.