AI Act Data Traceability Checklist

The AI Act compliance deadline is August 2026. Your SME doesn’t need Atlan to make it.

I keep getting asked about AI Act compliance by founders and CTOs at scaleups. The conversation usually starts with a vendor quote attached, somewhere between 40K and 200K per year for a lineage tool. Then the question: “do we need this?”

Probably not. Here’s what the high-risk AI requirements actually demand for data traceability:

• Where did the training data come from? (source URLs, dataset names, vendor agreements)
• What’s in it? (schema, size, time range)
• How was it filtered or preprocessed? (deduplication rules, PII scrubbing, sampling)
• Who has access? (IAM groups, log who pulled it for training)
• When was it last updated? (timestamp, change log)
• Was it validated? (quality checks, manual review notes)

Six fields. Per dataset. That’s a markdown file or a small Notion page per training data source.

For a scaleup with three to ten high-risk training datasets, this fits on one page each. Total documentation effort: a week of work spread across two engineers. Total ongoing cost: 10 minutes per dataset update.

The enterprise lineage tools earn their money when you have hundreds of datasets, regulated industries with audit trails, or AI workloads where lineage is a product feature. Below that, you’re paying for capability you’ll never use.

Start with the six fields. Add a column to your data catalog. Move on. The AI Act doesn’t reward over-engineering.

How many high-risk AI datasets does your org train on today?