- Data provenance is the documented history of a dataset: who created it, how it was collected, under what terms, and what was done to it.
- Buyers need provenance to defend their use of data and to meet training data disclosure rules.
- A dataset card or manifest records provenance in a format both sides can check.
- Researchers auditing public AI datasets have found widespread gaps in license and source information.
What provenance covers
- Origin: the systems and people that created the data
- Collection: when, how and under what notice or consent
- Rights: ownership and license basis for each part
- Processing: cleaning, de-identification, filtering and labeling steps
- Chain of custody: who has held copies since
Why it matters now
Training data transparency rules require developers to describe their datasets. California AB 2013 requires disclosure of training data sources, including whether data was purchased or licensed (LegiScan). The EU AI Act sets transparency duties for general-purpose AI models (European Commission). The Data Provenance Initiative has audited licenses and sources of widely used AI datasets (Data Provenance Initiative).
How to document it
The "datasheets for datasets" approach proposes that every dataset ship with documentation of motivation, composition, collection, processing, uses and distribution (Gebru et al.). A data manifest with per-record rights flags is the practical version for licensing. See how to build a data manifest.
Questions
Who is responsible for provenance, buyer or seller?
Both. The seller documents origin and rights; the buyer keeps records of what they acquired and how it was used.