AIPOM Data Readiness Audit
What Is It
Assess whether named data is fit for a specific AI behavior and decision. Examine provenance, quality, coverage, representativeness, consent, privacy, access, freshness, change, and operational stewardship without collapsing critical gaps into an average score.
Why Use It
“We have the data” says nothing about whether it is lawful, representative, current, usable, or capable of supporting the intended behavior. Readiness is purpose-specific and must constrain the next decision.
When to Use It
Use before training, retrieval, evaluation, launch, or expanded use when data materially shapes behavior. This is not a legal, privacy, or security approval and should route those decisions to accountable specialists.
What It Produces
- Data-use boundary and readiness profile
- Evidence, assumptions, and critical gaps
- Allowed, constrained, prohibited, or deferred uses
- Remediation actions, owners, tests, and review date
Who Should Participate
Include the Product Manager, data owner and steward, engineering, domain experts, affected-user representation, and privacy, security, legal, or governance partners proportionate to the use.
Evidence to Bring
Bring behavior requirements, source maps, samples, lineage, collection purpose, consent or permission records, quality reports, subgroup coverage, freshness, transformations, access controls, incidents, and maintenance ownership.
How to Do It
- Define the exact behavior, decision, population, environment, and consequence.
- Inventory data sources, derivations, owners, permissions, and intended uses.
- Examine completeness, accuracy, consistency, timeliness, duplication, and label quality.
- Examine representativeness, affected groups, historical bias, missingness, and edge cases.
- Verify provenance, collection context, consent, privacy, security, access, retention, and deletion obligations with accountable partners.
- Assess drift, refresh, lineage, versioning, correction, and operational stewardship.
- Identify critical gaps and specify which decisions they constrain.
- Choose allowed, constrained, prohibited, or deferred use; avoid compensating averages.
- Define remediation, evidence tests, owners, and re-audit triggers.
Key Concepts
- Readiness is fitness for a named purpose, not a reusable score.
- Missingness may encode who the system fails to see.
- Permission to access is not automatically permission for every AI use.
- Operational ownership matters after the first audit.
Organizational Applications
Use for retrieval, evaluation datasets, model adaptation, decision support, personalization, automation, and vendor data transfers.
Common Pitfalls
- Auditing a dataset without the intended behavior
- Using one readiness average
- Treating volume as representativeness
- Assuming historical labels are ground truth
- Omitting consent, deletion, or downstream use
- Writing remediation with no owner or decision consequence
Combine With
Use authoritative-source-map for trust and ownership, aipom-golden-dataset-builder for representative evaluation sets, and aipom-initiative-readiness-review for cross-category launch decisions.
Assets and Templates
- Data readiness audit template
- Synthetic worked example
- Weak example
Sources
- NIST, AI Risk Management Framework 1.0, January 26, 2023. Supports lifecycle data quality, representativeness, privacy, documentation, and risk-management considerations. Accessed July 16, 2026.
Completing this audit does not establish legal, privacy, security, or regulatory compliance.
1---2name: aipom-data-readiness-audit3description: Assess whether data is fit for a specific AI product decision across provenance, quality, access, representativeness, consent, privacy, freshness, and operations.4---56# AIPOM Data Readiness Audit78## What Is It910Assess whether named data is fit for a specific AI behavior and decision. Examine provenance, quality, coverage, representativeness, consent, privacy, access, freshness, change, and operational stewardship without collapsing critical gaps into an average score.1112## Why Use It1314“We have the data” says nothing about whether it is lawful, representative, current, usable, or capable of supporting the intended behavior. Readiness is purpose-specific and must constrain the next decision.1516## When to Use It1718Use before training, retrieval, evaluation, launch, or expanded use when data materially shapes behavior. This is not a legal, privacy, or security approval and should route those decisions to accountable specialists.1920## What It Produces2122- Data-use boundary and readiness profile23- Evidence, assumptions, and critical gaps24- Allowed, constrained, prohibited, or deferred uses25- Remediation actions, owners, tests, and review date2627## Who Should Participate2829Include the Product Manager, data owner and steward, engineering, domain experts, affected-user representation, and privacy, security, legal, or governance partners proportionate to the use.3031## Evidence to Bring3233Bring behavior requirements, source maps, samples, lineage, collection purpose, consent or permission records, quality reports, subgroup coverage, freshness, transformations, access controls, incidents, and maintenance ownership.3435## How to Do It36371. Define the exact behavior, decision, population, environment, and consequence.382. Inventory data sources, derivations, owners, permissions, and intended uses.393. Examine completeness, accuracy, consistency, timeliness, duplication, and label quality.404. Examine representativeness, affected groups, historical bias, missingness, and edge cases.415. Verify provenance, collection context, consent, privacy, security, access, retention, and deletion obligations with accountable partners.426. Assess drift, refresh, lineage, versioning, correction, and operational stewardship.437. Identify critical gaps and specify which decisions they constrain.448. Choose allowed, constrained, prohibited, or deferred use; avoid compensating averages.459. Define remediation, evidence tests, owners, and re-audit triggers.4647## Key Concepts4849- Readiness is fitness for a named purpose, not a reusable score.50- Missingness may encode who the system fails to see.51- Permission to access is not automatically permission for every AI use.52- Operational ownership matters after the first audit.5354## Organizational Applications5556Use for retrieval, evaluation datasets, model adaptation, decision support, personalization, automation, and vendor data transfers.5758## Common Pitfalls5960- Auditing a dataset without the intended behavior61- Using one readiness average62- Treating volume as representativeness63- Assuming historical labels are ground truth64- Omitting consent, deletion, or downstream use65- Writing remediation with no owner or decision consequence6667## Combine With6869Use `authoritative-source-map` for trust and ownership, `aipom-golden-dataset-builder` for representative evaluation sets, and `aipom-initiative-readiness-review` for cross-category launch decisions.7071## Assets and Templates7273- [Data readiness audit template](template.md)74- [Synthetic worked example](examples/worked-example.md)75- [Weak example](examples/weak-example.md)7677## Sources7879- NIST, [AI Risk Management Framework 1.0](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10), January 26, 2023. Supports lifecycle data quality, representativeness, privacy, documentation, and risk-management considerations. Accessed July 16, 2026.8081Completing this audit does not establish legal, privacy, security, or regulatory compliance.
Dean Peters