# DAT-06 Training and RAG data provenance

Domain: DAT Data Protection & Privacy · HI-AAF v1.3 · Public review · https://humanintel.net/standard/dat/dat-06

Sources of training, fine-tuning, and RAG data are documented. Opt-out and consent requirements are honored.

The provenance of data used for training, fine-tuning, and retrieval-augmented generation is documented: where the data came from, under what terms, and what consent or opt-out obligations apply. Opt-out and consent requirements are honored at the data-ingestion layer, not as an afterthought. This control is increasingly critical as regulatory scrutiny of training-data provenance intensifies.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for DAT-06: Data sources are documented with provenance records; opt-out and consent mechanisms are operational; compliance is verified at a documented cadence; data sources lacking provenance are identified and remediated.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Data sources are documented with provenance records.
- Opt-out and consent mechanisms are operational.
- Compliance is verified at a documented cadence.
- Data sources lacking provenance are identified and remediated.

## Framework mappings

- NIST AI RMF: MEASURE 2.10
- ISO/IEC 42001: A.7.5
- OWASP LLM Top 10: LLM06
- SOC 2 (TSC): P3.1, P4.2
- EU AI Act: Art. 10(1), Art. 10(2)
- Singapore: PDPA s.13, MAIGF Data, AI Verify Data Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cited by INP-04 Sensitive content handling: https://humanintel.net/standard/inp/inp-04

## Cite this control

Human Intelligence. HI-AAF v1.3, DAT-06 Training and RAG data provenance. Public review edition, July 2026. https://humanintel.net/standard/dat/dat-06