Data Management Controls for AI

What it is

Data is where most AI risk begins. A model learns from training data, is adapted with fine-tuning data, answers from retrieval data, receives prompts and produces outputs. Each of these can expose confidential information, introduce bias or carry poisoned content.

Data management controls treat that risk across the AI life cycle: knowing where data came from, keeping it accurate and untampered, using only what is needed, and stopping sensitive data from leaking through the model.

How it works

Provenance and lineage

Provenance records where data came from, under what terms and how it was collected. Lineage traces how it was transformed and which models were built from it.

Together they answer key questions: may this data be used for this purpose, which models are affected if a source turns out to be poisoned or unlawful, and what must be retrained or deleted when a person exercises their rights. Lineage is recorded in the data catalogue and model registry.

Data quality and labelling

Defending against data poisoning

Poisoning works when an attacker can influence data the model learns from or retrieves. Controls:

• Restrict who can add or change training and retrieval data, with logging of changes.
• Use trusted sources and verify integrity with hashes or signatures.
• Validate and scan ingested data for anomalies, outliers and embedded instructions.
• Version datasets so a clean earlier version can be restored.
• Test models for unexpected behaviour on trigger-like inputs after training.
• Monitor retrieval sources that accept outside content, such as shared drives and websites.

Minimization and sensitive data

Data minimization means using only the data needed for the purpose. For AI this means removing direct identifiers and unneeded personal or confidential fields before training or indexing, because data learned by a model is hard to remove later.

Rights, licences and intellectual property

Before data is used, the organization confirms it has the right to use it for AI: consent or another lawful basis for personal data, licence terms for purchased or scraped data, and contractual limits on customer data. Copyrighted material and confidential third-party data need legal review.

Retention and deletion

Retention rules cover datasets, embeddings, logs and models. When data must be deleted, lineage shows which derived assets are affected. Removing learned information from a trained model is difficult; options include retraining without the data or retiring the model, so these consequences are considered when deciding what to train on.

Synthetic data

Synthetic data generated to resemble real data can reduce exposure of personal information in development and testing. It is not automatically safe: poorly generated synthetic data can still reveal real records, and it may not reflect real-world conditions, so it is validated for both privacy and usefulness.

A worked example

A team wants to fine-tune a model on five years of customer support tickets. Many tickets contain names, account numbers and occasionally passwords customers typed in.

The security manager requires a data review first. Identifiers and credentials are detected and removed, the lawful basis is confirmed with privacy, the cleaned dataset is versioned and hashed, access is limited to the project team, and lineage links the dataset to the resulting model. Output filtering is added as a second layer in case anything was missed.

How the exam asks about this

• "What is the BEST way to reduce the risk that a model reveals personal data from its training set?" Remove or minimize personal data before training, with output filtering as a further layer.
• "A training data source is found to be poisoned. What helps MOST to identify affected models?" Data lineage linking datasets to the models built from them.
• "Which control BEST prevents staff sending confidential data to an external AI service?" Data loss prevention on prompts, supported by acceptable use rules.