Dataset Registry

The Dataset Registry (/datasets) inventories the data assets used to train, fine-tune, evaluate, and operate AI systems. It is part of the ISO/IEC 42001:2023 module (Annex A.7 — Data for AI Systems) and is available to Professional and Enterprise tiers when the per-organization ISO 42001 toggle is enabled.

What you can record

Each dataset entry captures the metadata required by ISO 42001 Annex A.4.3 and A.7.2–A.7.5:

Name, owner & description — display name and accountable owner.
Provenance — source URL/API, source organization, date collected, narrative provenance.
Category — Training, Validation, Test, Production, or Operational.
Schema — structured / unstructured / semi-structured, file format, feature description.
Intended use — which AI systems and use cases consume the data (with explicit linkage tables).
Subject demographics & bias — population description, representativeness notes, known biases, formal bias-assessment status and remediation.
Labeling — labeling method, who labeled, label quality checks.
Data rights & licensing — license, copyright holder, consent basis, GDPR / CCPA flags, PII flag.
Lifecycle — Draft / Active / Under Review / Archived / Retired with retention period, retention notes, retirement reason.
Review schedule — last reviewed, next review date, review owner, review frequency.
Version history — append-only changelog with version label, narrative, and actor.

An ISO Coverage badge on the registry shows the percentage of these metadata fields populated for each dataset.

Linking to AI Systems

From a dataset row, open the side-sheet to link or unlink it to one or more registered AI Systems. Each link records the lifecycle stage (training, evaluation, fine-tuning, inference) and a usage purpose, providing end-to-end lineage between data and the systems that consume it.

Elevated review

Datasets flagged as Confidential, Restricted, or containing PIIrequire elevated approval and data-protection review under Annex A.7. The platform highlights these records and feeds them into the ISO 42001 Annex A coverage report.

Auditing & access

All actions write immutable entries to the org and Platform Activity Log:

DATASET_CREATED, DATASET_UPDATED, DATASET_DELETED
DATASET_AI_SYSTEM_LINKED, DATASET_AI_SYSTEM_UNLINKED
DATASET_USE_CASE_LINKED, DATASET_USE_CASE_UNLINKED
DATASET_LIFECYCLE_CHANGED — emitted on lifecycle status transitions
DATASET_REVIEWED — emitted by the "Mark Reviewed" row action; auto-rolls next_review_at forward when a Review Frequency is set
DATASET_VERSION_LOGGED — emitted when a new version/changelog entry is logged

Review cadence (None / Daily / Weekly / Monthly / Quarterly / Semi-Annually / Annually) is powered by the canonical scheduling module (src/lib/scheduling.ts). The "Due in N days" warning honours the per-dataset review_warning_days override; otherwise it falls back to the org-wide Advance warning for scheduled reviews setting (Admin Panel → Org Settings → Notifications, default 30 days).

Access is tenant-isolated via row-level security and additionally gated by tier and the ISO 42001 org toggle.