Proving your AI training data provenance (before a regulator or customer asks)

Every AI model is a function of its training data, and that data is becoming the part regulators and buyers ask about first. The EU AI Act requires providers of general-purpose and high-risk AI systems to document the data used to train them — its sources, its provenance, and the steps taken to govern it. Enterprise procurement is converging on the same question from the commercial side: before licensing your model, a buyer wants to know the training data was obtained legitimately and can be accounted for. In both cases, the failure mode is the same — being asked to prove something after the fact that you never recorded in a verifiable way.

The hard part is not having the data; it is proving what you had, and when. An internal spreadsheet listing dataset sources is easy to produce and impossible to trust, because the party presenting it is the party with the incentive to tidy it up. What a regulator or auditor actually needs is a record they can verify was created at the time and has not been altered since — the same non-repudiation standard applied to financial records. Provenance that can be silently edited is not evidence; it is an assertion.

The construction is well understood and cheap to adopt. For each dataset or data source, compute a hash of its contents (or its manifest), record the source, license, and collection date, and sign that record. Anchor the signature to a public timestamp — a randomness beacon or a public chain — so the 'when' is as verifiable as the 'what', and no one, including you, can backdate it. The result is a sealed provenance record: an auditor recomputes the hash, checks the signature and the timestamp, and confirms independently that this dataset existed in this form on that date. The trust rests on cryptography, not on your word, and the record reruns to the same result for anyone who checks.

Be precise about scope, because honesty is the whole value of the artifact. A sealed provenance record proves that a dataset existed in a specific form at a specific time and was attested by a specific key — integrity, prior-existence, and non-repudiation of what you declared. It does not, by itself, prove the data was collected lawfully, that the labels are correct, or that consent was obtained; those remain governance obligations you must meet and document separately. What it removes is the ability to quietly revise history, which is exactly what turns a data inventory into evidence. Sign with a post-quantum scheme (ML-DSA, FIPS 204) so the record stays verifiable over the long compliance horizon — resistant to known classical and quantum attacks per NIST, not unbreakable. Recording provenance at collection time costs almost nothing; reconstructing it under audit pressure, months later, can cost the deal or the certification.