For twenty years, data regulation asked a simple question: did you have permission to hold this? The AI Act asks a harder one. Can you show what the system did with it, and can you show it now.
That is a different kind of obligation. Consent is a state you can record once. Explainability is a property you have to keep true as the system changes underneath you.
What actually changed
The text does not require you to open your models. It requires you to produce, on request, a coherent account of the data that trained and fed them. Provenance, transformations, retention, and the controls that governed each step.
Most teams can produce two of those four. The provenance lives in a spreadsheet maintained by someone who has since changed roles. The transformations live in whichever orchestration tool was fashionable when the pipeline was written.
The gap is not technical. It is that nobody was asked to keep the record continuously, so nobody built the place to keep it.
The operator, not the vendor
The part that surprises people is where the obligation lands. If you deploy a model inside your own product, you are the operator. Buying the model from someone else moves almost none of the burden.
This has a practical consequence. A vendor compliance page is evidence about that vendor. It says nothing about the pipeline you built on top of it, and that pipeline is the part regulators will ask about.
Three things worth doing now
- Write down where each training set came from, at the field level. Not the dataset. The field. When a regulator asks why a decision was made, the answer lives in a column, not a table.
- Version your transformations the way you version code. If a normalisation rule changed in March, the audit trail should say so without an archaeology project.
- Separate retention from deletion. Quarantining a bad record and deleting it look identical in most systems. They are not the same thing legally, and one of them destroys your evidence.
The uncomfortable part
None of this is about AI. It is about whether your data platform can answer questions about its own history. Teams that already have that answer are finding the AI Act mostly procedural. Teams that do not are discovering that the work was overdue in 2021 and the deadline simply arrived attached to a different acronym.
The good news is that the same instrumentation serves both. A pipeline that records what it validated, when, and against which rule is a pipeline that can answer a regulator without a special project.
