Publishing a Sufficiently Detailed Training Data Summary

When preparing training data summaries for AI models, providers must ensure that the documentation meets the detail levels required by the EU AI Act and related standards. The level of detail must be sufficient to support risk assessment, audit readiness, and compliance with transparency obligations. The data summary must reflect the composition, origin, and processing of data used to train or fine-tune generative AI models. This is especially important for providers of high-risk AI systems, as these must adhere to stricter documentation requirements under Article 50 of the AI Act.

Content Requirements for Training Data Summaries

A training data summary must include information such as the data sources, data types, data collection methods, data preprocessing steps, and any data filtering or curation processes. For example, if a model was trained on publicly available text from websites, social media, or news articles, these sources must be identified. The summary must also indicate whether data was collected through automated means or human curation, and whether any data was removed or modified during preparation. The data must be categorized by type, such as text, images, or audio, and grouped by origin or purpose where relevant.

• Include data sources such as public datasets, proprietary data, or third-party contributions
• Specify data types such as text, images, or structured data
• Document data collection methods including automated scraping or manual curation
• Record data preprocessing steps such as cleaning, normalization, or tokenization
• Identify any data filtering or exclusion criteria applied

Alignment with AI Management System Standards

Organisations must align their data summaries with ISO/IEC 42001:2023, which sets out requirements for AI management systems. Clause 7.3 of this standard specifies that organisations must maintain records of data used for AI system development. The data summary must support these records by providing sufficient detail to allow for traceability and audit purposes. For example, if a data set was derived from a public API, the summary must identify the API, its version, and any usage restrictions or terms of access. The data must also be tagged or categorised to reflect its relevance to the AI system’s intended use.

Where data was collected through human annotation or curation, the summary must indicate the roles of those involved, such as data scientists or domain experts. The process must be documented to show how data was reviewed, validated, or corrected. This is important for demonstrating due diligence, particularly when data was gathered from sensitive or regulated domains such as healthcare or finance. The data summary must also reflect any data governance policies or frameworks that guided the data handling process.

Meeting Transparency and Reporting Obligations

Under Article 50 of the EU AI Act, providers must make their AI systems transparent to users and regulators. This includes providing machine-readable data summaries for generative AI systems placed on the market after 2 August 2026. The data must be presented in a way that allows for machine interpretation, such as through structured formats or metadata. For example, data used to train a chatbot must be tagged with machine-readable identifiers such as data type, source, or date of collection. The data summary must also be accessible through the AI system’s documentation or through a designated data access portal.

Organisations must also consider the implications of data usage for downstream users. If data was derived from sources that are not publicly accessible or have usage restrictions, these must be clearly identified. The data summary must support any claims made about data neutrality or representativeness. For instance, if a model was trained on data from a single geographic region or demographic group, this must be clearly stated. The summary must also indicate whether data was anonymised or pseudonymised, and whether any privacy protections were applied during data handling.

By ensuring that training data summaries meet these requirements, providers can demonstrate compliance with the EU AI Act and support effective governance of AI systems. The documentation must be accurate, complete, and accessible to auditors or regulators. Regular updates to the data summary must be maintained to reflect any changes in data usage or system design. This practice helps organisations stay aligned with evolving regulatory expectations and maintain transparency in their AI development processes.