NIS2 compliance requires proof of which data was used for every automated decision, at what time, and with what level of integrity. Without sovereignty over training corpora, such demonstration becomes impossible.
A concrete scenario
A French SME develops an anomaly detection system based on a machine learning model trained using logs collected over two years. During a NIS2 audit, the authority requests proof that the data used complies with protection requirements and that the training process has not been tampered with.
Without strict traceability, the company can only provide a copy of the dataset stored on a network share: there is no reliable indication of who created the file, when it was modified, or whether the records have been altered. The audit fails, and partner trust is compromised.
Why dataset sovereignty is critical
- every decision made by an AI model must be defensible if challenged;
- biases present in training data must be auditable a posteriori;
- regulators (NIS2, EU AI Act) require the reconstruction of the datasets used for each version of the model;
- the retention of training data must comply with GDPR and the right to erasure;
- in the event of a compromise, it must be proven that the model has not been poisoned.
Expected qualities of dataset evidence
- authenticity: the corpus originates from the declared source;
- integrity: no alteration since creation (SHA-256 hashes);
- traceability: every modification recorded with identity and timestamp;
- qualified timestamping: legally recognised timestamp;
- attribution: clearly identified author or system;
- contextualisation: linkage to the trained model version;
- retention periods managed according to sector-specific requirements;
- independent verifiability without access to internal secrets.
Important reminder: immutability does not guarantee the veracity of the content. A sealed file may contain incorrect information from the moment of recording. The initial quality of the source remains essential.
Evidence likely to be requested
| Type of evidence | Concrete example |
|---|---|
| Training dataset | Timestamped export with SHA-256 hash, stored in WORM, associated with a model ID |
| AI Usage Policy | Git version signed with tag « ai-policy-v2026-Q3 » |
| Training pipeline | Append-only log containing commit IDs, dataset, and hyperparameters |
| Inference logs | SIEM with WORM retention and millisecond timestamping |
| Bias analysis | Signed report with hashed samples, published prior to production deployment |
| Proof of erasure | GDPR deletion log with proof of effect in subsequent models |
Immutability mechanisms applicable to datasets
| Mechanism | Contribution to the proof |
|---|---|
| WORM / S3 Object Lock | The dataset can no longer be altered once published for training |
| Merkle Chaining | Verification of a complete corpus in a single calculation |
| Qualified Timestamping | Legal probative value for the collection date |
| Signed Manifest | GPG-signed list of files + hashes, attached to the model |
| Legal Hold | Prevention of deletions during investigation or legal proceedings |
Chain of custody for a training dataset
- collection: automated export of business sources;
- identification: metadata (source, version, scope) and UUID;
- timestamping: qualified TSA call or secure NTP synchronisation;
- integrity calculation: SHA-256 hash stored separately;
- WORM storage with Object Lock;
- classification by sensitivity (personnel, technical, operational);
- role-based access control for ML/data science;
- retention according to sector policy (typically 3 to 5 years);
- periodic hash verification before each new training campaign;
- consultation or export via timestamped and logged package;
- end of retention: secure destruction or long-term archiving.
Governance and management accountability
NIS2 and the EU AI Act mandate that management bears responsibility for algorithmic decisions. This requires the immutable preservation of: AI policy validations, formal acceptance of residual risks, budget allocation for governance measures, and the tracking of post-audit remediation plans. Every decision must be electronically signed and linked to an identified version of the model.
Pragmatic implementation for SMEs and Mid-caps
- map the datasets used by each model in production;
- define a data custodian per corpus (data engineering, CISO, DPO);
- automate collection, hashing, and transmission to an S3 bucket with Object Lock;
- use Open-Timestamps or a qualified TSA to timestamp each manifest;
- schedule monthly integrity checks;
- simulate an audit request on a random dataset every quarter;
- train management on how to read an AI evidence register.
What KARL delivers
KARL enables the treatment of each training dataset as durable evidence: automatic versioning, WORM immutability, precise timestamping, unalterable access logs, and auditable exports. AI data sovereignty is no longer a complex project but a native property of the storage.
Further reading
To further explore the issue of AI system traceability:
Read the Challenges article on KARL →