AAIR lesson 7: AI data and asset management

AI data and asset management means knowing what AI systems, models and datasets the organisation has, where the data came from, who may use it, and how long it is kept. It matters because a model is only as sound as its data, and risk cannot be assessed for systems nobody has listed. Subtopic 2D of the AAIR outline covers this, and the life cycle figure in lesson 5 shows it as a bar underneath every stage rather than a step of its own. Three terms carry most of the lesson: provenance, lineage and inventory.

Data quality as a risk driver

Models learn patterns from the data they are given, so faults in the data become faults in behaviour. Quality is judged on several dimensions:

Quality needs owners and checks: profiling before training, rules at data entry points, and review when sources change. Data that is good enough for reporting may not be good enough for training.

Provenance and lineage

Provenance is the record of where data came from and on what basis it was obtained: the source, the collection date, the legal basis or licence, and any restrictions. Lineage traces how data moved and was transformed on the way to the model: cleaning, joining, labelling, feature creation. Together they answer questions that arise after something goes wrong, or when a regulator, customer or auditor asks.

• Can the organisation show it had the right to use this data for training?
• Which model versions used a dataset that is now found to be flawed or unlawfully obtained?
• Was any scraped, purchased or synthetic data included, and under what terms?

Without provenance and lineage, remediation means guessing. With them, an affected dataset can be traced to every model and decision it touched. Intellectual property and licence terms on training data are a recurring concern; lesson 11 covers contract clauses on data usage.

The AI inventory and asset register

An AI inventory is a maintained list of AI systems, with enough information to manage each. Typical fields are:

• System name, purpose and business owner
• Model type, version, and whether built, fine-tuned, bought or embedded in another product
• Data used, with classification and source
• Impact rating or risk tier
• Third parties involved
• Status in the life cycle, and date of last review

Models and datasets are assets and belong on the asset register in their own right, including copies in test environments and notebooks. The inventory is the first practical step of an AI risk programme because every later activity depends on it: classification, assessment, monitoring and incident response all start from the list. Finding unlisted use, often called shadow AI, is a continuing task, using procurement records, network or software discovery, and staff reporting. The data classification page explains the sensitivity levels that inventory entries should reuse rather than reinvent.

Access, retention and disposal

Access. Apply least privilege to training data, model files, prompts and logs. Separate who may change a model from who may use it. Training data containing personal or confidential information should be classified, and a model trained on sensitive data may deserve the same protection as the data itself, since outputs can reveal it.

Retention. Keep data and records only as long as a defined purpose or legal duty requires. Some items must be kept: evidence of validation, logs of decisions, approvals. Others should not be: raw personal data once training is complete, if no basis remains.

Disposal. Secure deletion must reach copies, backups, test environments and vendor-held data. A trained model can retain influence from deleted records, so disposal decisions should be made before training, not after.

Worked example: an unlisted chatbot at a 200-person firm

A 200-person engineering consultancy begins an AI risk programme and asks every department what AI it uses. Finance names one forecasting tool. Procurement records show three AI subscriptions, and the security team’s software scan finds a fourth: a project team has been uploading client drawings to a free online assistant. None of these were in any register.

The risk analyst creates an inventory with the fields above and ranks entries by data sensitivity. The assistant holding client drawings rises to the top because of confidentiality duties in client contracts. Actions follow: stop the uploads, review the vendor terms on data use, record the incident, offer an approved alternative, and set a retention rule for any AI logs. The first and cheapest control was discovery.

Easy to confuse

• Provenance vs lineage. Provenance is origin and rights; lineage is movement and transformation.
• Data quality vs data security. A dataset can be secure but wrong, or accurate but exposed.
• Inventory vs asset register. The inventory describes AI systems and their risk context; the register is the broader list of assets, which should include models and datasets.
• Deleting a record vs removing its influence. Deleting source data does not undo what a trained model learned.

Key points

• Data quality is judged on accuracy, completeness, representativeness, timeliness, consistency and integrity.
• Provenance records origin and rights; lineage records how data was transformed and where it went.
• The AI inventory is the first practical step, because risk cannot be assessed for unknown systems.
• Include shadow AI in discovery, using procurement records, scans and staff reporting.
• Apply least privilege, defined retention and verified disposal to data, models and logs.
• Plan disposal and retention before training, since a model may retain influence from data later deleted.

Check yourself

This lesson completes Domain 2 (AI Life Cycle Risk Management, 21%) with subtopic 2D. The life cycle risk recap summarises the full domain.