What it means
- Know where the data that trains, fine-tunes or feeds your AI came from, whether you are allowed to use it, and whether it is good enough.
- Provenance: source, date, licence or consent basis, any transformations applied.
- Quality: completeness, accuracy, freshness, duplicates, labelling errors, and fit for the intended use.
- Covers data across its lifecycle: collection, access, use, retention and deletion. Includes data sent to third-party models in prompts or retrieval (RAG) indexes.
Why it matters
- RBI FREE-AI expects AI data governed across its lifecycle in line with the DPDP Act.
- MeitY's 2026 advisory asks AI platforms to review training data as part of safeguards against unlawful content.
- Poor data is the most common root cause of bad AI decisions; regulators will ask "what data did this learn from?"
Checklist
- Create a dataset register for each AI system: source, owner, lawful basis or licence, collection date, sensitivity, transformations, retention.
- Define minimum quality checks (missing values, outliers, label accuracy sample, duplicates) and run them before training and on each refresh.
- Record data lineage from source systems to model features or RAG indexes.
- Check licences for scraped or purchased datasets; block data with unclear rights.
- Classify data using the existing information classification scheme and restrict sensitive data.
- Review data used by GenAI tools and retrieval indexes for content that should not be there.
- Re-run quality checks when sources change.
Evidence examples
- Dataset register or datasheet for the fraud model's training data, with source and licence.
- Data quality report from the last training run (for example null rates, label audit sample results).
- Lineage diagram from core banking tables to model features.
- Approval record for use of a purchased third-party dataset, including licence review.
Common pitfalls
- Using production customer data for training without checking it was collected for that purpose.
- No record of which dataset version trained which model version.
- Ignoring data in RAG indexes and prompts, which can leak or carry unlawful content.
- Quality checks done once at build time, never on refresh.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- BindingTexas TRAIGA
- SupervisoryOSFI E-23
- SupervisoryMeitY AI and Deepfake Advisories
- VoluntaryRBI FREE-AI
Also relevant to
- ICMR AI in Healthcare Guidelinesno numbered obligations; mapped in its practical notes (data quality and representative training data)
- Tamil Nadu Safe and Ethical AI Policyno numbered obligations; mapped in its practical notes (diverse, certified training data)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- A.4.3 Data resources
- A.7.2 Data for development and enhancement of AI systems
- A.7.3 Acquisition of data
- A.7.4 Quality of data for AI systems
- A.7.5 Data provenance
- A.7.6 Data preparation
ISO/IEC 27001
- A.5.12 Classification of information
SOC 2
- PI1.2
Key takeaways
- Track where AI data came from, whether you may use it, and whether it is good enough.
- Mostly new for AI. ISO 27001 overlap is partial and weak: information classification (A.5.12) helps restrict sensitive data, but provenance and quality for training are not covered.
- Link dataset versions to model versions.