Dataset Card Builder and Scorer
A dataset card answers the questions someone asks before training on your data: why it exists, what is in it, how it was collected and cleaned, and what it must not be used for. This builder asks the Datasheets for Datasets questions, section by section, scores how complete your answers are, and turns them into a Hugging Face dataset card and a Croissant RAI file.
Who this is for: GRC and compliance teams who need training-data documentation as evidence, and AppSec and AI-security engineers who publish or consume datasets and want the card and the machine-readable file to say the same thing.
What this tool is
- 63 questions in the seven sections of Datasheets for Datasets (Gebru et al.): motivation, composition, collection process, preprocessing and labelling, uses, distribution and maintenance.
- Each question shows where the same answer goes in Google Data Cards, the Hugging Face dataset card and Croissant RAI, so one set of answers feeds all four.
- A live score per section and overall, with the gaps listed: Croissant-required answers first, then the core answers a reviewer looks for.
- Downloads: a Hugging Face README.md (YAML front matter plus the template sections), a Croissant 1.1 JSON-LD file with the RAI fields filled from your answers, and a PDF, CSV and JPG of the result.
- "Load Northwind example" fills the form with a fictional, complete dataset card for northwind/support-tickets-2025. Runs in your browser; nothing is uploaded.
Every question, and where it goes in each format
The four dataset-card formats overlap more than they differ. The table lists every question in the builder under its Datasheets section, with the heading or property that holds the same answer in the extended Google Data Card template, the Hugging Face dataset card and Croissant. A blank cell means that format has no dedicated place for it. Croissant properties marked required must be present for a valid Croissant 1.1 file (mlcroissant also reports an error for a file without a checksum).
The builder fills 15 of the 20 properties in the Croissant RAI 1.0 vocabulary. The other five (rai:dataImputationProtocol, rai:dataManipulationProtocol, rai:dataAnnotationAnalysis, rai:annotatorDemographics and rai:machineAnnotationTools) apply to fewer datasets; add them by hand if yours needs them. For a walk-through of each format, read dataset card templates compared and Croissant and Croissant RAI with an example.
3.1 Motivation
Why the dataset exists, who made it and who paid for it.
| Question | Google Data Cards | Hugging Face card | Croissant |
|---|---|---|---|
| Dataset ID or nameWhat is the dataset called? Use the ID people will type. | Dataset Name (title) | pretty_name and the card title | namerequired |
| SummaryDescribe the dataset in a short paragraph: what it holds and what it is for. | Summary paragraph under the title | Dataset Description | descriptionrequired |
| PurposeFor what purpose was the dataset created? Was there a specific task in mind, or a gap to fill? | Motivations & Intentions › Purpose(s) | Curation Rationale | — |
| Created by (organisation)Which organisation created the dataset? | Authorship › Publishers | Curated by | creatorrequired |
| Team, and on whose behalfWhich team or group created it, and on behalf of which entity? | Authorship › Dataset Owners | Curated by | — |
| Funded byWho funded the creation of the dataset? Name any grant. | Authorship › Funding Sources | Funded by | — |
3.2 Composition
What is in it, how much, what is missing, and whether it holds confidential or sensitive data.
| Question | Google Data Cards | Hugging Face card | Croissant |
|---|---|---|---|
| What one record isWhat do the instances represent (documents, photos, people, transactions)? Is there more than one type? | Dataset Overview › Data Subject(s), Content Description | Dataset Structure | recordSet description |
| Number of recordsHow many instances are there in total? | Dataset Overview › Dataset Snapshot | size_categories | — |
| Language(s)Which language(s) is the content in? Use BCP-47 codes, comma-separated. | — | language | inLanguage |
| All instances or a sample?Does it contain all possible instances or a sample of a larger set? Is the sample representative, and how do you know? | Sampling Methods | — | — |
| Fields in each recordWhat data does each instance consist of? One field per line as "name: description". Add a type in brackets if not text, e.g. "closed_on [Date]: …". | Example of Data Points › Data Fields | Dataset Structure (and dataset_info.features) | recordSet › field |
| Label or targetIs there a label or target associated with each instance? | Annotations & Labeling | Annotations | — |
| Missing informationIs any information missing from individual instances, and why? | Transformations › Cleaning Missing Value(s) | — | rai:dataCollectionMissingData |
| Recommended splitsAre there recommended splits (train, validation, test)? Why those? | Use in ML or AI Systems › Split Statistics | configs and dataset_info.splits | — |
| Errors, noise, redundancyAre there any errors, sources of noise or redundancies in the dataset? | Relationship to Source › Limitation(s) and Trade-Off(s) | Bias, Risks, and Limitations | rai:dataLimitations |
| External resourcesIs the dataset self-contained, or does it link to or rely on external resources? Will they stay available? | Provenance › Data Integration | — | — |
| Confidential dataDoes it contain data that might be confidential (legal privilege, doctor–patient confidentiality, non-public communications)? | Sensitivity of Data › Sensitivity Type(s) | Personal and Sensitive Information | rai:personalSensitiveInformation |
| Offensive or distressing contentDoes it contain data that might be offensive, insulting, threatening or cause anxiety? | — | Bias, Risks, and Limitations | — |
| SubpopulationspeopleDoes it identify any subpopulations (by age, gender, and so on)? How, and in what proportions? | Human and Other Sensitive Attributes | — | rai:personalSensitiveInformation |
| Can individuals be identified?peopleIs it possible to identify individuals, directly or indirectly (combined with other data)? How? | Sensitivity of Data › Field(s) with Sensitive Data | Personal and Sensitive Information | rai:personalSensitiveInformation |
| Sensitive categoriespeopleDoes it contain sensitive data: racial or ethnic origin, sexual orientation, religion, political opinions, union membership, location, financial, health, biometric or genetic data, government IDs, criminal history? | Sensitivity of Data › Sensitivity Type(s) | Personal and Sensitive Information | rai:personalSensitiveInformation |
3.3 Collection process
How, when and by whom the data was collected, and whether people were told.
| Question | Google Data Cards | Hugging Face card | Croissant |
|---|---|---|---|
| How the data was acquiredHow was the data for each instance acquired: directly observed, reported by subjects, or inferred from other data? Was it verified? | Provenance › Collection › Method(s) Used, Methodology Detail(s) | Data Collection and Processing | rai:dataCollection |
| Collection typeWhich kind of collection was it? (Croissant RAI recommended values.) | Provenance › Collection › Method(s) Used | — | rai:dataCollectionType |
| Source of the raw dataWhat mechanisms or sources produced the data (sensors, manual curation, software, APIs, an internal system)? | Provenance › Collection › Source Description(s) | Who are the source data producers? | rai:dataCollectionRawData |
| Who collected itWho was involved in collecting the data (staff, contractors, crowdworkers) and how were they paid? | — | Who are the source data producers? | — |
| Collection startOver what timeframe was the data collected? Start date. | Provenance › Collection › Collection Cadence | — | rai:dataCollectionTimeframe |
| Collection endEnd date of the collection timeframe. | Provenance › Collection › Collection Cadence | — | rai:dataCollectionTimeframe |
| Ethical reviewWere any ethical review processes conducted (for example by an institutional review board)? With what outcome? | — | — | — |
| Collected directly or via third parties?peopleWas the data collected from the individuals directly, or obtained via third parties or other sources? | Provenance › Collection › Source Description(s) | — | — |
| Notice, consent and revocationpeopleWere the individuals notified? Did they consent? Can they revoke consent? Quote or link the notice. | — | — | — |
| Impact analysis (e.g. DPIA)peopleHas an analysis of the impact on data subjects, such as a data protection impact assessment, been done? Outcome? | Sensitivity of Data › Risk(s) and Mitigation(s) | — | — |
3.4 Preprocessing, cleaning and labelling
What was done to the raw data, and how labels were made.
| Question | Google Data Cards | Hugging Face card | Croissant |
|---|---|---|---|
| Preprocessing and cleaning stepsWas any preprocessing, cleaning or labelling done (filtering, de-duplication, de-identification, tokenisation)? One step per line. | Transformations › Transformation(s) Applied | Data Collection and Processing | rai:dataPreprocessingProtocol |
| Raw data kept?Was the raw data saved as well as the processed data? Where? | — | — | — |
| Software usedIs the software used to preprocess, clean or label the data available? Link it. | Transformations › Library(ies) and Method(s) Used | — | — |
| How labels were madeHow were the labels created: by whom, with what instructions, and how were disagreements resolved? | Annotations & Labeling › Annotation Description(s), Annotation Task(s) | Annotation process | rai:dataAnnotationProtocol |
| Who created the labels (category)Hugging Face category for the label source. | Annotations & Labeling › Annotation Workforce Type | annotations_creators | — |
| Annotation platform or toolWhich platform, tool or library was used to collect the labels? | — | Who are the annotators? | rai:dataAnnotationPlatform |
| Labels per recordHow many human labels does each record have? | — | — | rai:annotationsPerItem |
3.5 Uses
What it has been used for, what it should and should not be used for.
| Question | Google Data Cards | Hugging Face card | Croissant |
|---|---|---|---|
| Used for so farHas the dataset been used for any tasks already? Which models or systems? | Intended Use › Dataset Use(s); Known Applications & Benchmarks | Direct Use | rai:dataUseCases |
| ML taskWhich machine-learning task is it for? (Hugging Face task id.) | — | task_categories | — |
| Other suitable tasksWhat other tasks could the dataset be used for? | Intended Use › Suitable Use Case(s) | Direct Use | rai:dataUseCases |
| Risks for future usesIs there anything about the composition or collection that could lead to unfair treatment, legal or financial harm? What can a user do to mitigate it? | Sensitivity of Data › Risk(s) and Mitigation(s) | Bias, Risks, and Limitations › Recommendations | rai:dataSocialImpact |
| Known biasesWhich groups, channels or cases are missing, under- or over-represented? | Relationship to Source › Limitation(s) and Trade-Off(s) | Bias, Risks, and Limitations | rai:dataBiases |
| Do not use forAre there tasks for which the dataset should not be used? One per line. | Intended Use › Unsuitable Use Case(s) | Out-of-Scope Use | rai:dataLimitations |
3.6 Distribution
Who gets it, how, when and under which licence.
| Question | Google Data Cards | Hugging Face card | Croissant |
|---|---|---|---|
| Shared outside your organisation?Will the dataset be distributed to third parties outside the entity that created it? | Access, Retention & Wipeout › Access Type | — | — |
| How it is distributedHow will it be distributed (download, API, data catalogue, Hugging Face Hub)? Does it have a DOI? | Access › Documentation Link(s) | — | — |
| Dataset URLThe web page or catalogue entry for the dataset. | Dataset Link | Repository | urlrequired |
| Main file nameThe file people download (relative to the dataset URL). | — | — | distribution › FileObject name, contentUrl |
| File formatMIME type of the main file. | — | — | distribution › FileObject encodingFormat |
| SHA-256 of the fileChecksum so a user can confirm they have the exact file. mlcroissant reports an error for a file without sha256 or md5. | — | — | distribution › FileObject sha256required |
| Date publishedWhen was (or will) the dataset be distributed? | — | — | datePublishedrequired |
| LicenceWhich copyright or IP licence, or terms of use, apply? Use an SPDX ID (CC-BY-4.0, Apache-2.0) or a name such as "Proprietary". | Access › Policy Link(s) | license (license_name, license_link if other) | licenserequired |
| Licence URLLink to the licence text. Needed when the licence is not an SPDX ID. | — | license_link | license (URL) |
| Third-party IP restrictionsHave any third parties imposed IP-based or other restrictions on the data? | — | — | — |
| Export controls and regulationDo any export controls or other regulatory restrictions apply to the dataset or individual records? | — | — | — |
3.7 Maintenance
Who looks after it, how it is updated and how long it is kept.
| Question | Google Data Cards | Hugging Face card | Croissant |
|---|---|---|---|
| Maintained byWho will support, host and maintain the dataset? | Authorship › Dataset Owners | — | rai:dataReleaseMaintenancePlan |
| ContactHow can the owner or curator be contacted? | Dataset Owners › Contact Detail(s) | Dataset Card Contact | — |
| VersionCurrent version. Croissant recommends MAJOR.MINOR.PATCH. | Dataset Version and Maintenance › Version Details | — | version |
| ErratumIs there an erratum? Link it, or say there is none yet and where one would appear. | — | — | — |
| Update planWill the dataset be updated (fix labels, add or delete records)? How often, by whom, and how will users hear about it? | Dataset Version and Maintenance › Maintenance Plan | — | rai:dataReleaseMaintenancePlan |
| Retention limitspeopleAre there limits on how long data about people is kept? How are they enforced? | Access, Retention & Wipeout › Retention | — | — |
| Older versionsWill older versions stay available? If not, how will their end be communicated? | Provenance › Version and Maintenance | — | rai:dataReleaseMaintenancePlan |
| ContributionsCan others extend or contribute to the dataset? How are contributions checked and shared? | — | — | — |
The Northwind example
The example is the training dataset of the AIBOM Library's worked system: northwind/support-tickets-2025, 48,210 de-identified customer support tickets closed in 2025, used to fine-tune northwind/triage-assistant 2.3.0 (a LoRA fine-tune of mistralai/Mistral-7B-Instruct-v0.3) to draft replies a human agent approves. It is proprietary, internal only, and its free text can still mention health conditions, so the sensitive-data answers matter. The same dataset appears as Croissant in the AIBOM Template Library. Fictional example. Northwind Health, its support-tickets dataset, URLs, people and policies are invented for illustration. The base model named in it (mistralai/Mistral-7B-Instruct-v0.3) is real.
How the score works
- Each question counts once. Core questions (the ones a reviewer reads first, such as purpose, sensitive data and licence) count double.
- An answer counts when it is there and usable: dates must be YYYY-MM-DD, URLs must be links, the checksum must be 64 hex characters, and descriptive answers such as the summary need more than a few words. “TBD” and “[More Information Needed]” do not count.
- “No” is a valid answer. Datasheets asks many yes/no questions, and “No, there are no demographic fields” is exactly what a reader needs.
- Questions about people drop out only when you untick “relates to people”. Datasheets says any dataset of text written by people relates to people.
Where the card fits in an AIBOM
An AIBOM names each dataset a model was trained and evaluated on. The dataset card is what that entry should point to. The AIBOM data section guide covers what the AIBOM itself must record about datasets and licences, the AIBOM Format Field Map shows where the same facts go in CycloneDX and SPDX, and the Model Card Scorer does for the model what this tool does for the data. For high-risk systems under the EU AI Act, see the Annex IV technical documentation guide. Everything else is on the AIBOM Library hub.
Sources
Section names, questions, headings, YAML keys and property names checked against these on 29 October 2026. Hugging Face values for size_categories and annotations_creators come from the huggingface/datasets resource files, and task ids from huggingface.js.
- Gebru et al., Datasheets for Datasets (arXiv:1803.09010 v8, December 2021)
- Pushkarna, Zaldivar and Kjartansson, Data Cards: Purposeful and Transparent Dataset Documentation for Responsible AI (FAccT 2022, arXiv:2204.01075)
- Google PAIR Data Cards Playbook and extended Data Card template
- Hugging Face dataset card template (datasetcard_template.md)
- Hugging Face dataset card metadata spec (datasetcard.md)
- Hugging Face docs: Dataset Cards
- MLCommons Croissant 1.1 specification (published 2026-01-29)
- MLCommons Croissant RAI 1.0 specification
- EU AI Act, Annex IV point 2(d) (AI Act Service Desk)
Frequently asked questions
What is a dataset card?
A short document that travels with a dataset and answers the questions a user needs before training on it: why it exists, what is in it, how it was collected and cleaned, what it should not be used for, who maintains it and under which licence. Datasheets for Datasets (2018), Google Data Cards (2022), the Hugging Face dataset card and Croissant RAI are four formats for the same idea.
What questions does a datasheet for a dataset include?
Datasheets for Datasets groups its questions into seven sections: motivation (purpose, creators, funding), composition (what an instance is, how many, missing data, splits, confidential and sensitive data), collection process (how, by whom, when, ethical review, notice and consent), preprocessing/cleaning/labeling, uses (past uses and tasks to avoid), distribution (how, when, licence, restrictions) and maintenance (owner, contact, updates, retention, older versions). Questions about people can be skipped only if the dataset does not relate to people, and the paper says to read that broadly: text written by people relates to people.
How do I write a Hugging Face dataset card?
Put a README.md in the dataset repository. It starts with YAML metadata between --- lines (for example pretty_name, license, language, task_categories, size_categories and annotations_creators) and continues with the template sections: Dataset Details, Uses (Direct Use, Out-of-Scope Use), Dataset Structure, Dataset Creation (Curation Rationale, Source Data, Annotations, Personal and Sensitive Information), Bias, Risks, and Limitations, Citation, and Dataset Card Contact. A licence that is not on the Hub list is written as license: other with license_name and license_link.
Which Croissant RAI fields describe how a dataset was collected?
rai:dataCollection (the process), rai:dataCollectionType (from a list of recommended values such as Web Scraping, Surveys or Customer feedback data), rai:dataCollectionRawData (the source), rai:dataCollectionTimeframe (start and end) and rai:dataCollectionMissingData. Preprocessing goes in rai:dataPreprocessingProtocol and labelling in rai:dataAnnotationProtocol, rai:dataAnnotationPlatform and rai:annotationsPerItem. The file declares http://mlcommons.org/croissant/RAI/1.0 in conformsTo next to Croissant 1.1.
Does the EU AI Act require a datasheet for training data?
For high-risk AI systems, Annex IV point 2(d) lists, where relevant, “the data requirements in terms of datasheets” describing the training methodologies and the training data sets: a general description, provenance, scope and main characteristics, how the data was obtained and selected, labelling procedures and data cleaning methodologies. The collection and preprocessing sections of a datasheet answer those items. Whether your system is high-risk, and what else you owe, is a legal question this tool does not answer.
Does a high score mean the dataset is fit to use?
No. The score measures whether each question has a usable answer, not whether the answer is good news. A dataset can score 100% while stating that it holds health data and has no consent. The card makes those facts visible; a reviewer still decides.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.