Supply Chain – Datasets

• Use trusted data sources

  Organizational & process-based

  Effect

  Preventive

  Implementation level

  Data, Supply chain

  Classification and rationale

  Complementary control typeTechnical

  Primarily organizational and process-based: Defined selection, operating, or lifecycle procedures make the control binding and repeatable; complemented by technical implementation.

• Data provenance tracking

  Technical

  Effect

  Detective

  Implementation level

  Data

  Classification and rationale

  Complementary control typeOrganizational & process-based

  Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.

• Dataset validation and integrity checks

  Technical

  Effect

  Preventive, Detective

  Implementation level

  Data

  Classification and rationale

  Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

• License and copyright compliance audits

  Governance & compliance

  Effect

  Detective

  Implementation level

  Data, Supply chain, Organization

  Classification and rationale

  Complementary control typeOrganizational & process-based

  Primarily a governance and compliance control: Binding rules, control objectives, or oversight define permitted use and accountability; complemented by binding workflows.

• Support downstream providers Art. 25 Abs. 2, Art. 25 Abs. 4 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028 · amended by Reg. 2026/1744

  Statutory roles: Provider, Provider of a general-purpose AI model. Classes: High-risk under Annex III, High-risk as a product or safety component.

  Regulation (EU) 2026/1744 spelled out the initial provider duty to cooperate and at the same time created an exception: it does not apply where the initial provider has clearly specified that their system must not be turned into a high-risk system. Infringements of Art. 25(2) and (4) are now expressly subject to fines.

  This reference is a review prompt. A threat match alone does not establish applicability.

• Draw up the technical documentation of the model Art. 53 Abs. 1 Buchst. a, Anhang XI · applies from 2 August 2025

  Statutory roles: Provider of a general-purpose AI model. Classes: General-purpose AI model, Model with systemic risk.

  This reference is a review prompt. A threat match alone does not establish applicability.

• Provide information to downstream providers Art. 53 Abs. 1 Buchst. b, Anhang XII · applies from 2 August 2025

  Statutory roles: Provider of a general-purpose AI model. Classes: General-purpose AI model, Model with systemic risk.

  This reference is a review prompt. A threat match alone does not establish applicability.

• Respect copyright and summarise the training content Art. 53 Abs. 1 Buchst. c und d · applies from 2 August 2025

  Statutory roles: Provider of a general-purpose AI model. Classes: General-purpose AI model, Model with systemic risk.

  For models released under a free and open-source licence with publicly available parameters, the obligations under points (a) and (b) do not apply, but the copyright policy and the summary do. Models with systemic risk are excluded from this relief.

  This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

• Data Poisoning Manipulated training or reference data steers a model wrong on purpose.
• Fine-tuning An existing model is trained further on your own data.

What is Supply Chain – Datasets?

Training and fine-tuning data from external sources can be poisoned, flawed, or legally tainted. The model learns these defects along with everything else; beyond skewed or harmful outputs, copyright and data protection violations can follow.

Which mitigations help against Supply Chain – Datasets?

The catalogue lists 4 mitigations, each with control type, effect and implementation level. First among them are Use trusted data sources, Data provenance tracking and Dataset validation and integrity checks.

Which EU AI Act obligations does Supply Chain – Datasets touch?

The catalogue maps this threat to Art. 25 Abs. 2, Art. 53 Abs. 1 Buchst. a, Art. 53 Abs. 1 Buchst. b and Art. 53 Abs. 1 Buchst. c und d of the EU AI Act. In the obligations compass this leads to: Support downstream providers, Draw up the technical documentation of the model, Provide information to downstream providers and Respect copyright and summarise the training content. Whether an obligation applies depends on role, risk class and deadline.