Governance Before AI Act Fines

The provenance record behind an AI feature fits in a YAML file next to the pipeline code.

When the AI Act comes up, SME data leads often ask me which catalog to buy. For a team with a few models and a few dozen source tables, a catalog is a lot of licence and setup to hold what fits in one small file per dataset.

If you’re providing a high-risk system, this file is a start on the data-governance record the AI Act asks for. The full record goes further: assumptions, whether the dataset suits the purpose, the bias work. Customers ask a version of it in security questionnaires too.

What I set up is one small file per dataset that feeds a model:

• Source: which system, which extract.
• Period: the date range it covers.
• Personal data: yes or no, the original purpose, and the lawful basis if applicable.
• Prep: filters, joins and exclusions, in plain sentences.
• Known gaps: what’s missing or skewed.
• Owner: a person’s name.

It lives in the repo, so it’s versioned with the pipeline and reviewed in the same pull request. When the extract changes, the diff shows it.

Known gaps is the field people leave blank. As a reviewer it’s the one I read first.

What would your team write under “known gaps” for the data behind your AI feature?