Dataset Card Templates: Datasheets to Croissant
Four dataset documentation formats matter. Datasheets for Datasets (Gebru et al.) is a question list in seven sections. Google’s Data Cards (Pushkarna et al., 2022) summarise 31 themes for mixed readers. The Hugging Face dataset card is a README with YAML metadata. Croissant 1.1 with the RAI 1.0 vocabulary is machine-readable JSON-LD. Only the datasheet asks about notice and consent directly, and the Hugging Face card has no maintenance or retention section, so check those gaps whichever you pick.
Use a datasheet when people need to judge a dataset, and Croissant when tools need to read it. The datasheet (Gebru et al.) is the only one of the four formats that asks directly whether people were told about and consented to the collection. The Hugging Face card is fine for publishing, but has no section for maintenance or deletion, so add one.
Who this is for: GRC and compliance leads who need training-data evidence for an audit or the EU AI Act, data owners writing the card, and AppSec engineers reviewing a third-party dataset before it reaches a fine-tune.
What are the main dataset card templates?
- Datasheets for Datasets. Gebru et al. borrowed the electronics datasheet: every dataset should come with one. The paper lists dozens of questions in seven sections: motivation, composition, collection process, preprocessing/cleaning/labeling, uses, distribution and maintenance.
- Google Data Cards. Pushkarna et al. (FAccT 2022) describe “structured summaries of essential facts” for everyone who touches a dataset, built from 31 themes and layered from overview to detail. The paper reports lessons from more than 20 Data Cards. Google PAIR’s Data Cards Playbook adds activities to create, evaluate and fill out a template and to audit a finished card; its own page notes the 2022 version “may not reflect current approaches”.
- Hugging Face dataset card. The
README.mdof a dataset repository. YAML metadata (license,annotations_creators,source_datasets,size_categories,task_categories,configs) plus Markdown sections from “Dataset Details” to “Dataset Card Contact”. - Croissant and Croissant RAI. MLCommons JSON-LD on schema.org. Croissant 1.1 (29 January 2026) describes the dataset, its files and its records;
license,creatoranddatePublishedare required. The RAI 1.0 vocabulary (6 March 2024) adds 20 properties such asrai:dataCollection,rai:personalSensitiveInformationandrai:dataBiases. Our Croissant RAI walkthrough builds one.
Question-by-question comparison
Each row is one thing a reviewer needs to know, with where each format records it. Data Card theme numbers are from Table 2 of the paper; Hugging Face sections are from the huggingface_hub template; Croissant names are from the 1.1 and RAI 1.0 specs.
| What a reviewer needs | Datasheets for Datasets | Google Data Cards | Hugging Face dataset card | Croissant 1.1 + RAI 1.0 |
|---|---|---|---|---|
| Why it exists | “Motivation” | Theme 11: explanations and motivations; theme 2: funding | “Curation Rationale” | description (core) |
| What is in it | “Composition”: instances, count, missing data, splits | Themes 6, 9, 10, 26: features, nature, typical and outlier examples, statistics | “Dataset Structure”; metadata size_categories, dataset_info | recordSet and field (core); rai:dataCollectionMissingData |
| Where it came from | “Collection Process”: how, who, over what timeframe | Themes 8 and 17: upstream sources, collection process | “Source Data”: collection and processing, who produced it; metadata source_datasets | rai:dataCollection, rai:dataCollectionType, rai:dataCollectionTimeframe; provenance via W3C PROV-O |
| Notice and consent | Asked directly: were people notified, did they consent, can they revoke it, was a data protection impact analysis done | Not a theme of its own; the paper treats consent as spanning the lifecycle; theme 24 covers regulatory policies such as GDPR | No section | No dedicated RAI property |
| Personal and sensitive data | “Composition”: can individuals be identified, does it contain sensitive or confidential data | Theme 28: representation of people; theme 24: compliance | “Personal and Sensitive Information” | rai:personalSensitiveInformation |
| Cleaning and labelling | “Preprocessing/cleaning/labeling”, including whether raw data was kept | Themes 18 to 21 and 23: processing, rating, labelling, validation, adjudication | “Annotations”: process, who the annotators are | rai:dataPreprocessingProtocol, rai:dataAnnotationProtocol, rai:annotatorDemographics, rai:machineAnnotationTools |
| Allowed and forbidden uses | “Uses”: including tasks it should not be used for | Themes 12, 13, 22: intended applications, safety, past usage | “Uses”: Direct Use, Out-of-Scope Use | rai:dataUseCases; usage conditions via usageInfo |
| Licence and distribution | “Distribution”: licence, third-party IP restrictions, export controls | Themes 1 and 3: publishers, access restrictions | Metadata license, license_name, license_link; gating fields | license (required, core) |
| Maintenance, versions, deletion | “Maintenance”: who maintains, erratum, updates, older versions | Themes 4, 5, 14, 15: wipeout and retention, updates, status, version differences | No section | version (core, semantic versioning); rai:dataReleaseMaintenancePlan |
| Bias and limitations | In “Uses”: anything in the composition or collection that could harm future uses | Themes 27 to 29: patterns and skews, representation, fairness | “Bias, Risks, and Limitations”, “Recommendations” | rai:dataBiases, rai:dataLimitations, rai:dataSocialImpact |
| Integrity | Not asked | Not a theme | No field | sha256 on each FileObject |
Three gaps matter for security and privacy reviews:
- Consent. Only the datasheet asks whether people were notified, whether they consented, and whether they can revoke it. Croissant RAI has no property for it.
- Deletion. Data Cards have a theme for “wipeout and retention policies”. The Hugging Face card has no maintenance section at all.
- Integrity. Only Croissant records a checksum (
sha256on each file). Without one, nobody can show that the data a model was trained on is the data the card describes.
One more trap: Hugging Face serves Croissant for Hub datasets automatically. When we fetched it for stanfordnlp/imdb on 29 October 2026, it declared Croissant 1.1 and described files and records, but held no rai: properties. “Has Croissant” does not mean “has responsible-AI documentation”.
The formats at a glance
| Format | Owner | Form | Machine-readable? | Best for |
|---|---|---|---|---|
| Datasheets for Datasets | Research paper: Gebru et al. (2018; CACM December 2021) | Question list, seven sections | No | Data owners and GRC: the questions an auditor will ask |
| Google Data Cards | Research paper: Pushkarna et al., FAccT 2022; Data Cards Playbook (Google PAIR) | Structured summary of 31 themes; questions at three depths (the paper calls them telescopes, periscopes and microscopes) | No; the paper’s example is a static PDF | Explaining a dataset to non-specialists and approvers |
| Hugging Face dataset card | Hugging Face | README.md: YAML metadata plus Markdown sections | Partly: the YAML block | Datasets published on or pulled from the Hub |
| Croissant 1.1 + RAI 1.0 | MLCommons | JSON-LD on schema.org; RAI is a separate vocabulary | Yes | Tools that load, catalogue or check datasets |
Which one should you use?
| Your situation | Use | Why |
|---|---|---|
| Documenting internal training data for an audit or the EU AI Act | A datasheet | It asks the consent, sensitive-data and maintenance questions directly, and Annex IV 2(d) uses the word “datasheets”. |
| Explaining a dataset to approvers who are not data specialists | A Data Card | Built for mixed readers, overview first, detail on demand. |
| Publishing a dataset on Hugging Face | The Hugging Face card, plus answers to the datasheet’s consent and maintenance questions | The Hub card has no consent or maintenance section; add them as your own headings. |
| Letting tools load and check the data | Croissant, with RAI properties filled in | Automatic Croissant covers files and fields only. Add the rai: properties yourself. |
| Recording the dataset in an AIBOM | A CycloneDX data component or SPDX DatasetPackage that links to the card | The card holds the explanation; the AIBOM holds the identity, licence and hash. |
Whichever card you write, the dataset also belongs in your AIBOM as a component with its version, licence and hash. The AIBOM data section covers those fields, and the SPDX 3.0 Dataset profile example shows the SPDX side.
Worked example: Northwind’s training data
Northwind Health (fictional) fine-tuned Triage Assistant v2.3 on northwind/support-tickets-2025. Here is what its datasheet says, and where the same answer goes in Croissant RAI.
| Question | Northwind’s answer (fictional) | Datasheet section | Croissant / RAI |
|---|---|---|---|
| Why it exists | To fine-tune Triage Assistant to draft support replies | “Motivation” | description |
| What is in it | 48,210 closed support tickets, January to December 2025. One record is one ticket thread | “Composition” | recordSet; size in description |
| Personal data | Direct identifiers removed by de-identification. Risk: free text can still describe a rare situation that points to one customer | “Composition”: can individuals be identified? | rai:personalSensitiveInformation |
| Notice and lawful basis | Recorded by Northwind’s privacy team in the DPIA, linked from the datasheet | “Collection Process”: notified, consent, impact analysis | No RAI property: link the DPIA from description |
| Cleaning | Names, email addresses, phone numbers and account numbers removed before training | “Preprocessing/cleaning/labeling” | rai:dataPreprocessingProtocol |
| Uses | Fine-tuning reply-drafting models. Not for profiling customers or any clinical decision | “Uses” | rai:dataUseCases |
| Licence | Proprietary, internal only. Never published | “Distribution” | license |
| Maintenance | Owner: Support Engineering. Deleted when the retention period in the DPIA ends | “Maintenance” | rai:dataReleaseMaintenancePlan |
Northwind Health and its Triage Assistant are a fictional example used across the PlayCISO AIBOM Library. All names, figures and evaluation results for it are invented for illustration.
The eval set, northwind/triage-eval-v4 (1,200 labelled tickets), needs its own short card: who labelled it, against what guideline, and that it never overlaps the training tickets. The full datasheet and Croissant file are in the AIBOM Template Library (Pro). For the model side, see Model card templates compared. Every AIBOM guide is on the AIBOM Library hub.
Frequently asked questions
What is a datasheet for a dataset?
A document that answers a fixed list of questions about a dataset, proposed by Gebru et al. (first posted 2018; latest arXiv version December 2021). The questions are grouped in seven sections: motivation, composition, collection process, preprocessing/cleaning/labeling, uses, distribution and maintenance. It needs no tooling: anyone can answer the questions in a document.
What is the difference between Datasheets for Datasets and Data Cards?
Datasheets are a question list for dataset creators. Data Cards, from Google Research (Pushkarna et al., FAccT 2022), are a structured summary designed for mixed readers, built from 31 themes and layered from overview to fine detail. Data Cards add themes datasheets do not name, such as funding, wipeout and retention policies, and regulatory or compliance policies.
What should a dataset card include?
At minimum: why the dataset exists; what one record contains and how many there are; where the data came from and when; whether it contains personal or sensitive data and how that was handled; how it was cleaned and labelled; what it should and should not be used for; its licence; and who maintains it, how it is versioned and when it is deleted.
Does Hugging Face generate Croissant metadata?
Yes. The Hub serves Croissant JSON-LD for datasets. When we fetched it for stanfordnlp/imdb on 29 October 2026 it declared Croissant 1.1 and described the files and record sets, but carried no Croissant RAI properties. Automatic Croissant tells tools how to load the data; it does not document collection, consent or bias.
Does the EU AI Act require dataset documentation?
For high-risk AI systems, yes. Annex IV point 2(d) asks providers for the data requirements “in terms of datasheets” describing the training data sets: their provenance, scope and main characteristics, how the data was obtained and selected, labelling procedures and data cleaning methods. A datasheet or Data Card answers most of that.
How do I document personal data in a dataset card?
Say whether individuals can be identified directly or indirectly, what sensitive categories are present, what was removed and how, whether people were told and what lawful basis or consent applies, and when the data is deleted. Datasheets ask most of these questions directly; in Croissant RAI the main field is rai:personalSensitiveInformation.
Sources
- Gebru et al., Datasheets for Datasets (arXiv v8, 1 December 2021)
- Pushkarna et al., Data Cards: Purposeful and Transparent Dataset Documentation for Responsible AI (FAccT 2022)
- Google PAIR: Data Cards Playbook
- huggingface_hub: dataset card template
- Hugging Face hub-docs: dataset card metadata spec
- MLCommons Croissant 1.1 specification (2026-01-29)
- MLCommons Croissant RAI 1.0 specification (2024-03-06)
- AI Act Annex IV (AI Act Service Desk)
Checked on 29 October 2026. PlayCISO is not affiliated with any organisation named here.
Ready to practise the decisions these articles describe?
Run your first War Room free →One run free with a free account · more runs with Pro