What is AI data governance?
The short answer
AI data governance is the rules and records for which data goes into an AI system and how to prove its origin. EU AI Act Article 10 requires documenting data origin and preparation for high-risk systems. For owners: inventory systems, review contracts, exclude risky categories and document the review.
The phrase has two meanings. One is governing the AI system itself, which NIST's framework covers. The other is governing the data you feed it, which is the sense I use here.
What does the NIST AI Risk Management Framework say?
NIST released AI RMF 1.0 for voluntary use. It sets four functions: Govern, Map, Measure and Manage. NIST published a Generative AI Profile, NIST AI 600-1.
The framework covers risk management for AI systems in general. NIST's page does not mention data governance as such, so it gives a company licensing records no checklist of its own.
What does EU AI Act Article 10 require?
Article 10 applies to high-risk AI systems that train on data. It says training, validation and testing data sets must follow governance practices that cover:
- the design choices behind the data set
- the data collection processes and where the data came from
- for personal data, the original purpose it was collected for
- preparation steps such as annotation, labelling, cleaning and aggregation
- an examination of possible biases and the gaps in the data
Those duties fall on the providers of the AI system. The text names no owner. A buyer that has to document data origin may ask an owner for the same facts.
What does it look like for a company with records to license?
Frankfurt Kurnit Klein & Selz published a checklist for companies weighing a data deal. It tells them to involve legal, privacy, security, HR and communications people, inventory systems and record types, and review customer, partner, vendor and platform terms.
It also says to exclude categories such as privileged material, HR files, payroll, health information, union communications and customer confidential data, then to document the review.
Ownership, access, retention and consent all sit inside those steps. They are questions about who holds rights to the records, who can reach them, how long copies live and what people were told.
Why do buyers ask owners about it?
California's AB 2013 took effect on 1 Jan 2026. Crowell's alert says it requires developers of generative AI for public use in California to post details of their training data.
Those details cover where it came from, how it was gathered, whether licensed material was used and whether it includes personal information.
A buyer in that position has a reason to ask where your records came from. See what data provenance is.
Where do you start?
Our data readiness checklist and inventory template cover the first step. The rights check turns contract and consent questions into a short form, and the risk map shows where objections have come from.
We gather facts and give no legal advice. Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
