Model provenance
What it means
What is model provenance?
Model provenance is a traceable record of where a model comes from. That means which base model it started from, what data trained or fine-tuned it, and what licence covers the result. A buyer needs this to know what it may do with the output.
Article 53 of the EU AI Act turned this from a private claim into a published one for general-purpose models. Providers must publish a sufficiently detailed summary of training content, following a template the AI Office issued. That summary covers the scale of the data, and whether it includes licensed material, scraped web content, user data or synthetic data.
For a smaller company building on someone else's model, provenance is a due-diligence question, not a publishing duty. Work through it before signing, not after. That distinction decides who actually reads the summary, and when. The company reads the summary before it signs a contract, not after a customer's legal team goes looking for where the data came from.
Published · Updated
In practice
Why it comes up
A customer’s legal team asks it once a product’s output could plausibly end up in something they publish, resell or use to make a decision. They inherit whatever rights problem the underlying model carries. It also comes up quietly in procurement: the model actually behind a feature can differ from what the vendor’s marketing page implies. That gap widens once a vendor swaps providers without telling anyone.
What to do about it
Ask every model vendor what data trained the model, or where its training-data summary sits if the vendor owes one. Ask what licence covers the weights and output. Record the answer in the AI register next to that system, not in an email thread nobody can find during a review. The AI readiness and risk assessment reads the actual vendor list, not a list a company describes from memory.
Sources and neighbours
Sources
- Article 53 - Obligations for Providers of General-Purpose AI Models
eur-lex.europa.eu