Quality, lawful basis, and the licence question
Lesson 2 of 5 in Data Governance and Documentation Artifacts for AI.
Provenance tells you where data came from; three further tests decide whether you may — and should — train on it: is it good enough, is it legal under privacy law, and is it licensed under IP law? Each test has its own logic, and passing one buys you nothing on the others.
Quality first, because regulators now define it. For AI, quality is not one number but five dimensions with governance teeth: accuracy (are values correct), completeness (what is missing, and is missingness itself patterned by group), representativeness (does the data reflect the population the system will meet — the dimension whose failure produced Gender Shades), timeliness (does yesterday’s data describe tomorrow’s world), and label quality (were the “ground truth” labels themselves correct and consistent — the dimension whose failure produced the Obermeyer finding that a cost label made an American health algorithm systematically underestimate Black patients’ needs). The EU wrote these into law for high-risk systems: Article 10 requires training, validation, and testing data to be relevant, sufficiently representative, and to the best extent possible free of errors and complete in view of the intended purpose — the statutory detail lives in the EU AI Act domain; here, note that each phrase maps to a quality dimension your pipeline must measure, not just assert.
Privacy lens
The tension: GDPR demands data minimisation and purpose limitation; machine learning wants everything, forever. Both principles still apply to training pipelines — “we might need it for a model someday” is not a purpose.
The live questions. Lawful basis for training: consent rarely scales to training-set size, so providers lean on legitimate interests — the ground EU regulators have accepted in principle for model training (the EDPB’s December 2024 opinion sketched the conditions) while insisting on the three-part test: real interest, necessity, and a balancing that data subjects would not lose. Re-use: training a new model on data collected for service delivery is a purpose change requiring a compatibility analysis (Art 6(4)) — the step most retrofitted AI programs skipped. Special categories: if the data includes health, biometrics, or ethnicity — or reliably infers them — Art 9 conditions stack on top.
Copyright lens
The tension: most valuable training corpora contain copyrighted works; whether training is fair use (US) or covered by a TDM exception (EU) has been litigated on dozens of fronts.
Where it stood as of late 2025 (date-stamp everything here): US courts split along a lawfulness-of-acquisition line — in Bartz v. Anthropic (N.D. Cal. 2025) training on lawfully acquired books was held transformative fair use while the retention of pirated copies was not, and the case settled for $1.5 billion, the largest copyright settlement in history. Thomson Reuters v. Ross (2025) rejected fair use for a non-generative legal-research tool. NYT v. OpenAI and the Getty/Stability actions continued. In the EU, the Art 4 TDM exception plus machine-readable opt-outs is the operating rule, enforced through the AI Act’s Art 53 copyright-policy duty.
The practitioner’s translation: provenance records must capture acquisition lawfulness (bought, licensed, scraped, pirated?) and opt-out compliance — the two facts on which the litigation now turns.
Contract & licence lens
The tension: “open” datasets and models ship under licences with real obligations, and enterprise data ships under contracts with real restrictions.
The working checklist. Dataset licences: CC-BY requires attribution; CC-NC forbids your commercial use; ODbL is share-alike; many research datasets are non-commercial only — a fact that has embarrassed more than one production system. Model licences: RAIL (Responsible AI Licence) families attach use restrictions to weights; Llama-style community licences carry scale thresholds and naming duties; none of these is “open source” in the OSI sense, whatever the marketing says. Vendor indemnification: an actual market now exists — major genAI vendors offer copyright indemnities for output claims, with carve-outs (you often lose cover if you disabled safety filters or fine-tuned). Read the carve-outs; they are the product.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.