Before a model exists: framing and data

Lesson 2 of 5 in The AI Lifecycle: From Data to Deployment to Retirement.

The most consequential governance decisions happen before anyone writes a line of code, because stage 1 is where the only free veto lives: should we build this at all?

Not every problem should be solved with AI, and not every AI solution should exist. The Dutch tax authority did not need a self-learning fraud-risk model to administer childcare benefits — and when it built one anyway, on data that included nationality, the toeslagenaffaire wrongly ruined tens of thousands of families and eventually brought down the government in 2021. The cheapest point to prevent that catastrophe was a design-stage question: is an opaque risk score an acceptable tool for decisions this severe?

Design is also where the sourcing decision gets made, and each route carries a different governance profile: build your own model (maximum control, maximum duty), buy a finished product (you inherit the vendor’s choices and become a deployer), fine-tune someone else’s foundation model (shared responsibility — and under the EU AI Act, a substantial modification can make you the provider), or call an API (fastest, least visibility into what you are relying on).

Walk the sourcing decision

Interactive decision tree — outcomes:

  • Don’t build it

    The strongest governance decision is sometimes no AI. A transparent rule is auditable, contestable, and free of drift. “Should we build this at all?” is a real question with a real no-branch — frameworks like the NIST AI RMF explicitly include not deploying among valid risk responses.

  • Build in-house

    You control data, testing, and design — and you own every provider obligation that comes with that control: data governance, technical documentation, validation evidence, post-market monitoring. Maximum control, maximum accountability.

  • Fine-tune a foundation model

    Shared-responsibility territory. You inherit the base model’s unknowns (training data, biases) while adding your own. Contract for documentation from the upstream provider — and know that substantially modifying a system can shift provider duties onto you.

  • Buy or subscribe

    Fastest route, least visibility. Your governance work shifts to procurement: demanding documentation, testing evidence, and contractual rights to audit. You are the deployer — the duties of context (oversight, monitoring in use, informing affected people) are still yours.

Then comes stage 2 — data — where more governance outcomes are determined than at any other point in the lifecycle. Four questions dominate:

Where did it come from? Web scraping, licensing, purchase from brokers, your own users. Each source carries different legal rights and different quality. Clearview AI scraped billions of face images without consent and collected regulatory penalties across three continents; the LAION dataset behind popular image generators was found in 2023 to contain child sexual abuse material — nobody had looked. Provenance is not paperwork; it is the difference between an asset and a liability.

May you use it? Consent, lawful basis, purpose limitation — the GDPR vocabulary applies with full force to training data containing personal information. “It was publicly available” has repeatedly failed as a defence.

Who touched it? Labels are made by people — often thousands of annotation workers, frequently in low-income countries, sometimes labeling traumatic content for under $2 an hour, as TIME’s 2023 reporting on outsourced moderation-data work for OpenAI documented. The human supply chain of data is itself a governance issue.

Whom does it represent? Representativeness decides who the model works for. Skewed data does not announce itself — it has to be measured, subgroup by subgroup, and documented in artifacts like datasheets for datasets. Synthetic data can fill gaps, but it inherits the blind spots of whatever generated it.

Key terms: data provenance, representativeness, datasheets for datasets, synthetic data, lawful basis

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.