Glossary

Data provenance

Written with AI from the sources below and checked against our facts sheet. Last checked 7 Nov 2026. How this site is made · Spot an error?

Part of: EU AI Act

Data provenance is the documented origin of data: who created or collected it, when, from what source, and under what authority, consent or license. For AI, it shows whether training data is authentic and lawful to use. It differs from data lineage, which tracks what happened to the data after it was collected.

In plain English

In the art world, provenance is a painting's ownership history. It shows the work is genuine and was not stolen. Data provenance does the same for a dataset. Where did this come from, who collected it, when, and were we allowed to use it this way?

Good provenance records cover the source, the collector, the collection date, the legal basis or consent, the license terms and the original purpose. For bought data, they add the supplier's declarations and proof of lawful collection.

Provenance is the origin story. Data lineage is the journey that follows: every join, filter and label on the way into a model. Our data provenance vs data lineage comparison sets the two side by side.

Example

Paperkite Labs, a fictional startup, is fine-tuning a model that summarizes commercial contracts. Before training, its provenance review checks four candidate datasets:

Dataset	Provenance finding	Decision
Contracts uploaded by paying customers	Terms allow service delivery, not model training	Excluded unless customers opt in
Public court filings	Public source; court and filing dates recorded	Included
Licensed contract library	License covers commercial model training	Included
Scraped web pages from a data broker	No source list; no proof that rights reservations were respected	Rejected

The review takes a week. It also prepares Paperkite for the questions enterprise customers ask during vendor due diligence.

Why it matters

EU AI Act, high-risk systems. Data governance must address data collection processes and the origin of data, plus the original purpose of personal data (Art. 10(2)(b)). Technical documentation must include "information about their provenance, scope and main characteristics" for training data (Annex IV, point 2(d)).
EU AI Act, GPAI models. Providers must publish a summary of training content using the Commission's template, published on 24 July 2025 (Art. 53(1)(d)). They also need a copyright policy that respects text and data mining opt-outs (Art. 53(1)(c)).
Privacy. Under the GDPR, reusing personal data for training needs a lawful basis and a purpose compatible with the original one (Arts. 5(1)(b) and 6(4)). Provenance records show what the original purpose was.
NIST. The AI RMF says maintaining the provenance of training data supports transparency and accountability. It adds that training data may be subject to copyright (section 3.4).

How the AIGP exam tests it

Lesson III.B.2 pairs provenance with lineage. Swapped definitions are a classic distractor.

The tell. Questions about the source, the collector, the license, consent or authenticity are provenance questions. Questions about transformations and versions are lineage questions.
Trap 1: trusting the vendor. "The broker says the data is representative and lawfully collected" is a claim, not evidence. Ask for provenance documentation.
Trap 2: data provenance vs content provenance. Metadata or watermarks showing that an image is AI-generated are content provenance. Art. 50(2) of the AI Act requires machine-readable marking of synthetic outputs from 2 Aug 2026. That concerns outputs, not training data.
The BEST answer. To show training data is accurate, representative and lawfully obtained, track provenance and lineage together.

Frequently asked questions

What is the difference between data provenance and data lineage?

Provenance is the origin: who collected the data, when, from where, and under what license or consent. Lineage is the journey: every join, filter, label and version between the source and the model. Provenance answers whether you may use the data and whether it is genuine. Lineage answers whether it was corrupted or skewed on the way.

Why does data provenance matter for AI?

It shows whether you are allowed to use the data and whether it is genuine. Provenance records the license, consent and original purpose behind each source, which drives copyright, privacy and contract compliance. It also helps judge quality and bias, because knowing who collected the data and how reveals who might be missing.

What is content provenance?

Content provenance tracks the origin and edit history of a piece of content, such as an image or video, often through metadata or watermarks. It helps people tell AI-generated material from authentic material. The EU AI Act requires providers of generative systems to mark synthetic outputs in a machine-readable way (Art. 50(2)). Data provenance concerns training and input data instead.

Does the EU AI Act require data provenance?

Yes, in substance. High-risk providers must address data collection processes and the origin of data (Art. 10(2)(b)). Their technical documentation must cover the provenance of training data (Annex IV, point 2(d)). GPAI model providers must publish a summary of training content using the Commission's template (Art. 53(1)(d)).

Sources

Spot an error? Tell us