WhatsApp and Telegram +44 7563 115980
[email protected]
How to prove where training data came from and who allowed its use: the provenance record, the layers of rights that must be cleared, and how the answer differs for company records, supplier data, public web content and open datasets.
Since 2013 we have helped firms with due diligence and data services, in more than 60 countries.
The short answer
Data provenance is the documented history of a dataset: where each part came from, who created it, how it was collected and every hand it passed through. Rights clearance is confirming, in writing, that whoever licenses the data is entitled to allow the intended use. For AI training, that means checking copyright, database right, contracts and confidentiality, privacy law and any text and data mining opt-outs. Together they let a buyer show regulators, rights holders and its own board that each dataset was lawfully obtained.
On this page
The two terms are related but not the same. Data lineage tracks how data moves and changes inside systems: which table fed which report, and what transformations were applied. Data provenance goes further back and wider: where the data originated, who created it, under what terms it was obtained and who has held it since.
For AI training, provenance is the part that carries legal weight. The EU AI Act requires providers of general-purpose AI models to document the type and provenance of training data, how it was obtained and selected, and how it was curated (Annex XI). The US Copyright Office's 2025 report found that whether training is fair use depends partly on the source of the works used, and that illegal access weighs against it.
| Field | What it records | Why it matters |
|---|---|---|
| Origin | The system, organisation or website each source came from | Decides which rights and laws apply |
| Creator | Who wrote or produced the material: staff, contractors, customers, suppliers or the public | Decides who owns the copyright |
| Collection method | Export from company systems, supplier delivery, crawling, download or manual creation | Shows whether access was lawful and whether opt-outs apply |
| Dates | When the data was created and collected, and the latest collection date | Required in the EU AI Act template; database right runs from dates |
| Terms | The licence, contract or terms of use under which it was obtained | Sets the uses that can be passed on |
| Chain of custody | Every party that has held the data and every transfer | Shows that each party could pass on the rights |
| Processing | Filtering, de-identification, labelling and merging applied | Shows what the buyer is actually receiving |
| Exclusions | What was removed and why | Proves sensitive and unlicensable material is out |
We clear copyright, database right, contracts and privacy for each dataset and deliver a rights record a legal team can rely on.
Speak to an expertAI training dataSome laws allow text and data mining (automated analysis of text and data to find patterns) without permission. They are narrower than often assumed.
A direct licence from the rights holder removes reliance on any exception. It is also reported differently under the EU AI Act, with far less public disclosure required. Our EU AI Act training data summary guide explains why.
| Source | Main provenance question | How rights are usually cleared |
|---|---|---|
| Company's own records | Who created each item: staff, contractors, customers or suppliers? | Licence from the company for staff-created material; third-party material removed or separately licensed |
| Supplier or partner data | Did the supplier have the right to pass it on for this use? | Written licence with warranties and the supplier's own provenance record |
| Data from an intermediary | Can the intermediary show licences from the original rights holders? | Chain of licences back to the owners; otherwise treated as unlicensed |
| Public web content | Was access lawful, and were opt-outs respected? | Licence from the site owner, or reliance on an exception where one applies |
| Open datasets | What licence applies, and does it permit training and commercial use? | Compliance with the licence terms, which may prohibit training |
| Synthetic data | Which model generated it, and on what data was that model trained? | Terms of the generating model; disclosure in Section 2.5 of the EU AI Act template |
Provenance is not a one-off exercise. Where a licence includes regular deliveries of new data, each delivery needs its own entry in the provenance record: what was added, from which sources, under which terms and with which exclusions. A buyer that trains again on refreshed data needs those entries to update its own documentation, and in the EU to decide whether its training data summary must be updated.
We run this process for data owners through our data de-identification and rights clearance service, and every dataset supplied through our AI training data service carries the resulting rights record. Buyers checking a supplier's work can use our due diligence checklist.
The documented history of training data: where it came from, who created it, how it was collected, under what terms and every party that has held it. It lets a model builder show the data was lawfully obtained.
Lineage tracks how data moves and changes inside systems. Provenance records where data originated, who created it and under what rights it was obtained. For AI training, provenance carries the legal weight.
Confirming in writing that the party licensing the data is entitled to allow the intended use, after checking copyright, database right, contracts, confidentiality and privacy.
No. Public availability does not remove copyright or database right. In the EU, mining is allowed only where rights holders have not opted out, and in the UK only for non-commercial research.
In UK law, the employer owns copyright in works made by an employee in the course of employment, unless agreed otherwise. Work by contractors, customers and suppliers belongs to them unless assigned.
It allows mining of lawfully accessible works unless the rights holder has expressly reserved its rights, for example by machine-readable means online. Providers of general-purpose AI models must respect those reservations.
Only for non-commercial research, under section 29A of the Copyright, Designs and Patents Act 1988. Commercial AI training on protected material needs permission from the rights holder.
In the UK, 15 years from the end of the year the database was completed or, if it was made public within that period, 15 years from the end of the year it was first made public. A substantial new investment in its contents can start a new term.
Only with care. Customers usually own the copyright in what they write, and customer terms may limit how it is used. Their content is either removed, licensed through the customer terms, or covered by an exception that applies to the intended use.
Each point of law and each reported figure on this page was checked against these sources on 27 October 2026. This page is general information, not legal advice.
Tell us about the data and the uses that need to be cleared.