Many AI compliance failures are data failures. A model can be mathematically sound but still unsafe if the training data is incomplete, the labels are inconsistent, the population has changed or the organisation cannot show where an input came from.
Define data ownership
For every material dataset, identify the source, owner, lawful basis, quality controls, refresh cycle, retention rule and permitted use. Include derived variables, labels, vendor data and synthetic data. Data ownership should continue after the model enters production.
Test representativeness
Compare development data with the live population and with affected subgroups. Monitor missingness, coding changes, geography, product mix and outcome delay. A stable average can hide deterioration in a small but important population.
Link lineage to model decisions
A reviewer should be able to trace a material output from decision to feature, source record, transformation and model version. Changes to data pipelines need the same approval discipline as changes to code. Use the Commission AI framework as a reference for risk-based governance.