Training Data Quality & Provenance Checklist
Prove where your training and fine-tuning data came from, that you are allowed to use it, that it is good enough and that nobody poisoned it — with a dataset register that flags anything you should not train on yet.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- Twenty-nine checks across licensing, provenance, personal data, labelling, bias, poisoning, versioning and deletion — for models you train or fine-tune.
- ISO/IEC 5259 covers data quality for analytics and machine learning; ISO/IEC 8183 describes the stages data passes through in an AI system. The checks follow both, in plain language.
- A dataset register records source, licence or lawful basis, personal data, version hash, labelling method, bias check and retention per dataset.
- The summary names datasets with an unconfirmed basis, special category data, missing bias checks or no deletion date.
Frequently asked questions
What is training data provenance?
It is the documented history of a dataset: where it came from, how and when it was collected, who handled it, what was done to it, and on what basis you may use it. Provenance lets you answer a regulator, a customer or a court asking "what was this model trained on, and were you allowed to?" — and lets you find and remove bad data after the fact.
What are ISO/IEC 5259 and ISO/IEC 8183?
ISO/IEC 5259 is a multi-part series on data quality for analytics and machine learning — how to define, measure and manage the quality of data used to build models. ISO/IEC 8183 is a framework describing the life cycle of data in AI systems, from the idea for a dataset through collection, preparation, use and eventual decommissioning. This template draws on both in its own words; it does not reproduce them.
Does this apply if I only use retrieval (RAG) and do not train?
Partly. Licensing, personal data, poisoning defences and retention still apply to the documents you retrieve from; labelling and training-specific bias checks may not. Mark the items that do not apply as N/A.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.