How to Run a Provenance Audit of an Existing Training Corpus

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Why an audit of data in use differs from pre-purchase diligence

An audit of data already in use starts from artifacts (checkpoints, data loaders, bucket paths) rather than from a supplier's offer, so the first problem is finding what was used at all. Pre-signing diligence, covered in the AI training data due diligence checklist, asks a seller for evidence before money moves. A retrospective audit has no counterparty to ask, and often no one who remembers why a folder called sft_mix_v3_final exists.

The stakes are also different. Once data has shaped weights, remediation options narrow to re-licensing, retraining, restricting release scope or documenting an accepted risk. The audit's job is to tell you which of those applies to which model, with evidence an acquirer, enterprise customer or regulator can follow.

What the research says about inherited provenance

Published audits show that dataset metadata is unreliable enough that you should treat every license field as a claim to verify. The Data Provenance Initiative, a combined legal and ML team, traced more than 1,800 text datasets to their sources, creators and license conditions and found license omission rates above 70% and error rates above 50% on popular hosting sites [1]. A 2026 supply-chain audit, as summarized by Emergent Mind, reports that license text is missing for most datasets and models it examined [3].

Concrete examples matter in review meetings. Alpaca is distributed under CC BY-NC 4.0 and Dolly under CC BY-SA 3.0 [4], so an instruction mix that blended both may carry a non-commercial restriction and a share-alike condition the model card never mentions. Consent signals also move: a longitudinal audit of about 14,000 web domains documented how quickly robots.txt and terms-of-service restrictions on AI crawling changed [2]. A crawl snapshot that was permissive when collected may not match the source's current position, so record the date of every signal you rely on.

The eight-step audit sequence

The audit runs as a fixed sequence so every dataset gets the same treatment and the same evidence standard. Pair a legal reviewer with an ML engineer on every step, as the Data Provenance Initiative did [1]; lawyers cannot read data loaders, and engineers tend to trust license fields.

1. Scope. List the models in scope (production, internal, research) and their release status: API, open weights, embedded in a product, or internal only. Scope by model, not by bucket.
2. Inventory. Reconstruct the data actually used from training configs, data-loader manifests, tokenizer logs, eval harness configs and vector-store ingestion jobs. Hash shards so later questions resolve to exact files.
3. Classify source type. Tag each dataset as open dataset, web crawl, licensed third-party data, customer or user data, employee-authored data, human annotation, synthetic, or benchmark.
4. Trace. Follow each dataset to its original creator and every intermediate host or reseller. A Hugging Face mirror of a GitHub repo of a scrape is three hops, each of which can change the terms.
5. Verify evidence. Collect the license text, notices, contracts, consent records and opt-out snapshots themselves, not the metadata describing them [3]. Note what is missing.
6. Risk-rate. Score each dataset against how the models that used it are exposed (see the rating table below).
7. Remediate. Decide per dataset: keep, re-license, restrict model use, quarantine from future runs, or retire and retrain.
8. Record. Write results into a training data use register so the next audit starts from evidence instead of folklore.

Fields to capture for each dataset

Each register row should let a reviewer answer who made the data, under what terms, and which models consumed it, without opening another system. The Data Provenance Standards metadata categories are a useful field vocabulary, and where one dataset mixes sources you may need record-level provenance rather than a single row.

Illustrative example: invented to show structure; it does not describe an available dataset.

dataset_id: ds-0417
local_name: sft_mix_v3_final
content_hashes: [sha256 per shard]
source_type: open_dataset_blend
upstream_chain:
  - creator: "Original research group"
    host: "GitHub"
  - host: "Hugging Face mirror"
license_claimed: "apache-2.0 (HF metadata)"
license_verified: "Mixed: component A CC BY-NC 4.0; component B CC BY-SA 3.0"
evidence_files: [LICENSE_A.txt, LICENSE_B.txt, readme_snapshot_2026-09-30.html]
personal_data: "possible; user-written prompts"
consent_or_optout_evidence: "none located"
signal_dates: { license_checked: 2026-09-30 }
used_by_models: [assistant-7b-v2 (SFT), assistant-7b-v3 (SFT)]
used_for: [fine-tuning]
release_exposure: "commercial API, US and EU"
risk_rating: high
remediation: "Exclude component A from v4; counsel review for v2/v3"
owner: "data governance"

The gap between license_claimed and license_verified is the most common finding in practice and the one worth showing first in any summary.

How to risk-rate findings by model exposure

Rate risk by combining evidence quality with how the affected model is used, because the same gap matters more in a commercial open-weights release than in an internal research checkpoint. The NIST AI RMF's MAP and MEASURE functions are a reasonable frame for documenting this [7].

Illustrative example: invented to show structure; it does not describe an available dataset.

Add jurisdiction as a modifier. Generative AI systems or services made available to Californians fall under AB 2013, which required their developers to post training data documentation by January 1, 2026 [5]; general-purpose models placed on the EU market need a public training content summary under Article 53(1)(d), using the Commission template published 24 July 2025 [6]. An audit that cannot produce those summaries from evidence is itself a finding.

Legal context that shapes remediation priorities

As of October 2026, courts and settlements give governance teams reasons to prioritize datasets of uncertain origin, though no single ruling settles training generally. In Bartz v. Anthropic, the class settlement received final approval in July 2026 [8]. On September 29, 2026, the Third Circuit affirmed partial summary judgment for Thomson Reuters in its case against ROSS Intelligence, holding Westlaw headnotes copyrightable and ROSS's use of them to train a non-generative legal research tool not fair use [9].

Practical reading: put shadow-library content and scraped proprietary databases at the top of the remediation list regardless of license metadata. Have counsel apply these developments to your facts; do not extrapolate outcomes. The in-house counsel guide to AI data deals covers how legal reviewers triage this kind of risk.

Remediation options and audit outputs

Every high or critical finding should leave the audit with a named decision, an owner and a date. The realistic options are:

• Re-license: obtain a commercial license from the rights holder that covers past and future use, if one is available.
• Restrict: limit the affected model to uses the license allows, such as internal research only.
• Quarantine: add the dataset hashes to an exclusion list enforced by data loaders for all future training runs.
• Retire and retrain: remove the data and retrain or re-fine-tune, typically for critical findings in released models.
• Replace: source licensed data with documented provenance to fill the capability gap left by excluded sets.

The provenance gap remediation guide explains how to choose among these. Deliver three artifacts at close: the updated register, a machine-readable exclusion list keyed to content hashes, and a remediation plan sorted by risk rating. For open datasets you plan to keep, the open dataset license audit goes deeper on reading license text and attribution duties.

Audit checklist for governance leads

Use this checklist to confirm the audit is complete before you present it to a customer, regulator or acquirer.

Illustrative example: invented to show structure; it does not describe an available dataset.

• Every in-scope model maps to the exact datasets and shard hashes it consumed, including eval sets and RAG indexes.
• Each dataset has a source type, an upstream chain and a named original creator, or is marked "creator unknown".
• License text and notices are stored as files, not just metadata values.
• Consent, notice and opt-out evidence is dated; see consent and notice records.
• Personal data findings are flagged for privacy review, including user prompts and support transcripts.
• Each finding carries a risk rating tied to the model's release exposure and jurisdictions.
• Each high or critical finding has a decision, owner and target date.
• The exclusion list is wired into data loaders, and a test run proves it blocks quarantined hashes.
• AB 2013 and EU training content summaries can be regenerated from the register.
• The audit date and re-audit trigger (new model, new dataset, changed license) are recorded.

Filling gaps with documented operational data

When an audit retires datasets, the replacement should arrive with the evidence your register needs from day one. SourceX sources operational datasets from US companies on request, such as support and sales histories, engineering records, documents, and finance and legal workflows, and manages the licensing agreements and ongoing purchases. Every dataset is rights-reviewed for ownership and consents and delivered under a license that defines records, uses, term and delivery, with diligence materials on source, rights, preparation and allowed use prepared for each one. Personal details are removed or replaced before delivery, the method is recorded and a sample is checked, though no method is perfect. You can describe the data you need to replace; nothing is held in stock, and a request does not guarantee a match.

For the broader framework this audit sits in, start at the provenance hub, see AI training data compliance, or review the data provenance glossary entry.

Replace audited-out training data with licensed sources

If your audit leaves gaps in fine-tuning, eval or RAG data, SourceX looks for US businesses that hold the operational data you describe and runs the process from finding and assessing permissions through to an agreed license. Every release is approved by the supplying company, and nothing is contracted until the supplier agrees. Tell SourceX what data you need.