Building the foundations for trustworthy data and AI

Challenge

Companies are spending heavily on AI, and most of them can’t answer a basic question about the data underneath it: Where did this come from, what happened to it along the way, and is it fit for what we’re about to use it for? Having access to data is one thing. Being able to vouch for it is another.

Inside a large enterprise the problem compounds every time data crosses a boundary, from one department to another, from one system to the next, out to a vendor and back from a partner. Each system captures something different. Each organization has its own definitions and its own idea of what counts as documentation. By the time a dataset reaches the team training a model, the record of its origins is usually incomplete, inconsistent, or missing entirely.

The Data & Trusted AI Alliance (D&TA)set out to fix this by getting its member companies to agree on a common approach to data provenance. The hard part was never the technical specification. It was writing requirements that companies with different technology stacks, operating models, and priorities could all realistically adopt, and that a supplier in one industry could satisfy for a customer in another.

‍

Approach

As lead for the Alliance’s data provenance standards initiative, I spent nearly two years bringing together stakeholders from 19 companies, among them GM, Humana, IBM, Johnson & Johnson, Mastercard, Transcarent, UPS, and Walmart. Different industries, same questions:

·      What should an organization keep on record about its data?

·      How should changes and transformations be documented?

·      And what does another company need to know before it can use that data with confidence?

My job was to turn those questions into shared requirements, reconcile the views of companies that did not manage data the same way or want the same things from a standard, and keep the group focused on what enterprises would have to implement. A technically perfect standard that nobody can fit into their operations is a well-formatted document and not much else.

In the first two months, we established the scope and the vocabulary, which took longer than anyone expected because provenance meant something different to a retailer, a bank, and a health insurer. I then worked through more than twenty drafting cycles with the working group, testing each version against how member companies capture, maintain, and hand off data today. Where the technical people and the governance people disagreed, which was often, I kept the question on what a receiving organization needs to know and let that settle it. The standards were then tested externally, with a case study published on the outcome of testing by Alfaisal University, SDM Diagnostics, and LabTrace.

Outcomes

Agreement across 19 companies. The Alliance adopted common data provenance requirements and a shared definition of what it means to trust a dataset, the first of their kind across industries.

A practical foundation for implementation. The standards define what information an organization needs to capture and maintain to account for the origins and history of the data it uses, in terms a data team can act on.

A path to formal standardization. The work has moved into the OASIS standards process, opening it to broader industry participation, and is on track for ISO submission.

Data provenance established as an AI governance requirement. The initiative made provenance a recognized precondition for any credible claim about trustworthy AI, not an optional data-management nicety.

One framework instead of 19. Rather than every enterprise inventing its own approach, member companies and their suppliers now work from consistent expectations across industries and technology environments.

The work confirmed something I’ve seen repeatedly in enterprise governance. Writing the requirements is rarely the hard part. Getting organizations to agree on what those requirements mean, who is responsible for meeting them, and how they fit into operations that already exist is where the effort goes. For AI that work is no longer optional. A company can’t make credible claims about trustworthy AI if it can’t account for the