# Dataset Card Templates: Datasheets to Croissant

> Datasheets for Datasets, Google Data Cards, Hugging Face dataset cards and Croissant RAI compared question by question, with a filled Northwind example.

Source: https://playciso.com/blog/dataset-card-templates-compared · Published: 2026-10-29 · Publisher: PlayCISO (https://playciso.com)

---

Use a datasheet when people need to judge a dataset, and Croissant when tools need to read it. The datasheet (Gebru et al.) is the only one of the four formats that asks directly whether people were told about and consented to the collection. The Hugging Face card is fine for publishing, but has no section for maintenance or deletion, so add one. **Who this is for:** GRC and compliance leads who need training-data evidence for an audit or the EU AI Act, data owners writing the card, and AppSec engineers reviewing a third-party dataset before it reaches a fine-tune. ## What are the main dataset card templates? - Datasheets for Datasets. Gebru et al. borrowed the electronics datasheet: every dataset should come with one. The paper lists dozens of questions in seven sections: motivation, composition, collection process, preprocessing/cleaning/labeling, uses, distribution and maintenance. - Google Data Cards. Pushkarna et al. (FAccT 2022) describe “structured summaries of essential facts” for everyone who touches a dataset, built from 31 themes and layered from overview to detail. The paper reports lessons from more than 20 Data Cards. Google PAIR’s Data Cards Playbook adds activities to create, evaluate and fill out a template and to audit a finished card; its own page notes the 2022 version “may not reflect current approaches”. - Hugging Face dataset card. The README.md of a dataset repository. YAML metadata (license, annotations_creators, source_datasets, size_categories, task_categories, configs) plus Markdown sections from “Dataset Details” to “Dataset Card Contact”. - Croissant and Croissant RAI. MLCommons JSON-LD on schema.org. Croissant 1.1 (29 January 2026) describes the dataset, its files and its records; license, creator and datePublished are required. The RAI 1.0 vocabulary (6 March 2024) adds 20 properties such as rai:dataCollection, rai:personalSensitiveInformation and rai:dataBiases. Our Croissant RAI walkthrough builds one. ## Question-by-question comparison Each row is one thing a reviewer needs to know, with where each format records it. Data Card theme numbers are from Table 2 of the paper; Hugging Face sections are from the `huggingface_hub` template; Croissant names are from the 1.1 and RAI 1.0 specs. What a reviewer needsDatasheets for DatasetsGoogle Data CardsHugging Face dataset cardCroissant 1.1 + RAI 1.0 Why it exists“Motivation”Theme 11: explanations and motivations; theme 2: funding“Curation Rationale”`description` (core) What is in it“Composition”: instances, count, missing data, splitsThemes 6, 9, 10, 26: features, nature, typical and outlier examples, statistics“Dataset Structure”; metadata `size_categories`, `dataset_info``recordSet` and `field` (core); `rai:dataCollectionMissingData` Where it came from“Collection Process”: how, who, over what timeframeThemes 8 and 17: upstream sources, collection process“Source Data”: collection and processing, who produced it; metadata `source_datasets``rai:dataCollection`, `rai:dataCollectionType`, `rai:dataCollectionTimeframe`; provenance via W3C PROV-O Notice and consentAsked directly: were people notified, did they consent, can they revoke it, was a data protection impact analysis doneNot a theme of its own; the paper treats consent as spanning the lifecycle; theme 24 covers regulatory policies such as GDPRNo sectionNo dedicated RAI property Personal and sensitive data“Composition”: can individuals be identified, does it contain sensitive or confidential dataTheme 28: representation of people; theme 24: compliance“Personal and Sensitive Information”`rai:personalSensitiveInformation` Cleaning and labelling“Preprocessing/cleaning/labeling”, including whether raw data was keptThemes 18 to 21 and 23: processing, rating, labelling, validation, adjudication“Annotations”: process, who the annotators are`rai:dataPreprocessingProtocol`, `rai:dataAnnotationProtocol`, `rai:annotatorDemographics`, `rai:machineAnnotationTools` Allowed and forbidden uses“Uses”: including tasks it should not be used forThemes 12, 13, 22: intended applications, safety, past usage“Uses”: Direct Use, Out-of-Scope Use`rai:dataUseCases`; usage conditions via `usageInfo` Licence and distribution“Distribution”: licence, third-party IP restrictions, export controlsThemes 1 and 3: publishers, access restrictionsMetadata `license`, `license_name`, `license_link`; gating fields`license` (required, core) Maintenance, versions, deletion“Maintenance”: who maintains, erratum, updates, older versionsThemes 4, 5, 14, 15: wipeout and retention, updates, status, version differencesNo section`version` (core, semantic versioning); `rai:dataReleaseMaintenancePlan` Bias and limitationsIn “Uses”: anything in the composition or collection that could harm future usesThemes 27 to 29: patterns and skews, representation, fairness“Bias, Risks, and Limitations”, “Recommendations”`rai:dataBiases`, `rai:dataLimitations`, `rai:dataSocialImpact` IntegrityNot askedNot a themeNo field`sha256` on each `FileObject` Three gaps matter for security and privacy reviews: - Consent. Only the datasheet asks whether people were notified, whether they consented, and whether they can revoke it. Croissant RAI has no property for it. - Deletion. Data Cards have a theme for “wipeout and retention policies”. The Hugging Face card has no maintenance section at all. - Integrity. Only Croissant records a checksum (sha256 on each file). Without one, nobody can show that the data a model was trained on is the data the card describes. One more trap: Hugging Face serves Croissant for Hub datasets automatically. When we fetched it for `stanfordnlp/imdb` on 29 October 2026, it declared Croissant 1.1 and described files and records, but held no `rai:` properties. “Has Croissant” does not mean “has responsible-AI documentation”. ## The formats at a glance FormatOwnerFormMachine-readable?Best for Datasheets for DatasetsResearch paper: Gebru et al. (2018; CACM December 2021)Question list, seven sectionsNoData owners and GRC: the questions an auditor will ask Google Data CardsResearch paper: Pushkarna et al., FAccT 2022; Data Cards Playbook (Google PAIR)Structured summary of 31 themes; questions at three depths (the paper calls them telescopes, periscopes and microscopes)No; the paper’s example is a static PDFExplaining a dataset to non-specialists and approvers Hugging Face dataset cardHugging Face`README.md`: YAML metadata plus Markdown sectionsPartly: the YAML blockDatasets published on or pulled from the Hub Croissant 1.1 + RAI 1.0MLCommonsJSON-LD on schema.org; RAI is a separate vocabularyYesTools that load, catalogue or check datasets ## Which one should you use? Your situationUseWhy Documenting internal training data for an audit or the EU AI ActA datasheetIt asks the consent, sensitive-data and maintenance questions directly, and Annex IV 2(d) uses the word “datasheets”. Explaining a dataset to approvers who are not data specialistsA Data CardBuilt for mixed readers, overview first, detail on demand. Publishing a dataset on Hugging FaceThe Hugging Face card, plus answers to the datasheet’s consent and maintenance questionsThe Hub card has no consent or maintenance section; add them as your own headings. Letting tools load and check the dataCroissant, with RAI properties filled inAutomatic Croissant covers files and fields only. Add the `rai:` properties yourself. Recording the dataset in an AIBOMA CycloneDX `data` component or SPDX `DatasetPackage` that links to the cardThe card holds the explanation; the AIBOM holds the identity, licence and hash. Whichever card you write, the dataset also belongs in your AIBOM as a component with its version, licence and hash. [The AIBOM data section](/blog/aibom-data-section-datasets-licensing) covers those fields, and the [SPDX 3.0 Dataset profile example](/blog/spdx-3-ai-dataset-profile-example) shows the SPDX side. ## Worked example: Northwind’s training data Northwind Health (fictional) fine-tuned Triage Assistant v2.3 on `northwind/support-tickets-2025`. Here is what its datasheet says, and where the same answer goes in Croissant RAI. QuestionNorthwind’s answer (fictional)Datasheet sectionCroissant / RAI Why it existsTo fine-tune Triage Assistant to draft support replies“Motivation”`description` What is in it48,210 closed support tickets, January to December 2025. One record is one ticket thread“Composition”`recordSet`; size in `description` Personal dataDirect identifiers removed by de-identification. Risk: free text can still describe a rare situation that points to one customer“Composition”: can individuals be identified?`rai:personalSensitiveInformation` Notice and lawful basisRecorded by Northwind’s privacy team in the DPIA, linked from the datasheet“Collection Process”: notified, consent, impact analysisNo RAI property: link the DPIA from `description` CleaningNames, email addresses, phone numbers and account numbers removed before training“Preprocessing/cleaning/labeling”`rai:dataPreprocessingProtocol` UsesFine-tuning reply-drafting models. Not for profiling customers or any clinical decision“Uses”`rai:dataUseCases` LicenceProprietary, internal only. Never published“Distribution”`license` MaintenanceOwner: Support Engineering. Deleted when the retention period in the DPIA ends“Maintenance”`rai:dataReleaseMaintenancePlan` _Northwind Health and its Triage Assistant are a fictional example used across the PlayCISO AIBOM Library. All names, figures and evaluation results for it are invented for illustration._ The eval set, `northwind/triage-eval-v4` (1,200 labelled tickets), needs its own short card: who labelled it, against what guideline, and that it never overlaps the training tickets. The full datasheet and Croissant file are in the [AIBOM Template Library](/tools/aibom-template-library) (Pro). For the model side, see [Model card templates compared](/blog/model-card-templates-compared). Every AIBOM guide is on the [AIBOM Library hub](/aibom). ## Frequently asked questions ### What is a datasheet for a dataset? A document that answers a fixed list of questions about a dataset, proposed by Gebru et al. (first posted 2018; latest arXiv version December 2021). The questions are grouped in seven sections: motivation, composition, collection process, preprocessing/cleaning/labeling, uses, distribution and maintenance. It needs no tooling: anyone can answer the questions in a document. ### What is the difference between Datasheets for Datasets and Data Cards? Datasheets are a question list for dataset creators. Data Cards, from Google Research (Pushkarna et al., FAccT 2022), are a structured summary designed for mixed readers, built from 31 themes and layered from overview to fine detail. Data Cards add themes datasheets do not name, such as funding, wipeout and retention policies, and regulatory or compliance policies. ### What should a dataset card include? At minimum: why the dataset exists; what one record contains and how many there are; where the data came from and when; whether it contains personal or sensitive data and how that was handled; how it was cleaned and labelled; what it should and should not be used for; its licence; and who maintains it, how it is versioned and when it is deleted. ### Does Hugging Face generate Croissant metadata? Yes. The Hub serves Croissant JSON-LD for datasets. When we fetched it for stanfordnlp/imdb on 29 October 2026 it declared Croissant 1.1 and described the files and record sets, but carried no Croissant RAI properties. Automatic Croissant tells tools how to load the data; it does not document collection, consent or bias. ### Does the EU AI Act require dataset documentation? For high-risk AI systems, yes. Annex IV point 2(d) asks providers for the data requirements “in terms of datasheets” describing the training data sets: their provenance, scope and main characteristics, how the data was obtained and selected, labelling procedures and data cleaning methods. A datasheet or Data Card answers most of that. ### How do I document personal data in a dataset card? Say whether individuals can be identified directly or indirectly, what sensitive categories are present, what was removed and how, whether people were told and what lawful basis or consent applies, and when the data is deleted. Datasheets ask most of these questions directly; in Croissant RAI the main field is rai:personalSensitiveInformation. ## Sources - Gebru et al., Datasheets for Datasets (arXiv v8, 1 December 2021) - Pushkarna et al., Data Cards: Purposeful and Transparent Dataset Documentation for Responsible AI (FAccT 2022) - Google PAIR: Data Cards Playbook - huggingface_hub: dataset card template - Hugging Face hub-docs: dataset card metadata spec - MLCommons Croissant 1.1 specification (2026-01-29) - MLCommons Croissant RAI 1.0 specification (2024-03-06) - AI Act Annex IV (AI Act Service Desk) _Checked on 29 October 2026. PlayCISO is not affiliated with any organisation named here._