Artificial intelligence promises to reshape how we build products, make decisions, and operate entire businesses. Yet the foundations of modern AI are, to put it mildly, problematic. Most models were trained on data gathered through uncontrolled, often unethical, and in many cases outright illegal means. Large models were trained by scraping everything they could find on the public internet with little regard for copyright, accuracy, or the authenticity of sources.
We are now living with the consequences. Many of the answers people receive from today’s AI systems trace back not to vetted knowledge or licensed materials, but to random Reddit threads, satirical posts on X, or copyrighted content never attributed to its owners. This is the definition of garbage in, garbage out. Unfortunately, now the garbage is global, automated, and piped straight into decision-making processes.
We have accepted AI slop as a normal part of online life, but the real question is whether we want the same quality standards applied to critical business decisions. So far, the industry still behaves as if the answer was “yes”. Regulators, however, are beginning to think differently.
Why Logging Cannot Explain What Your AI Just Did
The classical approach to governance is built on logs, audit trails, and deterministic processes. Unfortunately, AI systems are none of these things. Training converts data into weights and tokens that cannot be reconstructed. Inference produces outputs that may differ every time the same prompt is used. Retrieval pipelines and agentic workflows bring in external data at runtime, often without any consistent record of what was used or why.
The result is an audit trail with gaps at every critical step. You can often track the inputs and the outputs, but the reasoning chain in between remains hidden. This is why traditional auditability is not the same as provenance. Provenance means being able to demonstrate where the data came from, how it was processed, how it influenced a model, and how that model produced a particular conclusion. Without it, organizations are left with decisions they cannot justify, even if the outcomes appear correct.
And without it, regulators cannot verify whether a model respects copyright or complies with industry rules. The friction between operational expectations and legal requirements is growing, and AI is now part of the software supply chain. That means your model vendor’s training data becomes your compliance risk.
The Regulatory Pressure Behind Provenance
Regulators did not start with explainability or algorithmic fairness. They started with copyright, because it is the most obvious and easiest to verify. Copyright owners have already demonstrated that training on protected content without permission is a violation, regardless of how useful the resulting model may be. This alone is driving the first round of regulatory intervention.
But copyright is only the beginning. Industries that rely on strong governance, including identity management and cybersecurity, face an even more fundamental problem. If the data feeding AI-driven decisions is incomplete, inaccurate, or unverifiable, those decisions become unreliable. For example, an access control recommendation based on a hallucination or a low-quality data source is not simply incorrect but a potential breach in the making.
This is why data provenance will evolve into the next major compliance requirement. The industry went through the same shift with privacy, culminating in GDPR and other similar frameworks. AI data provenance must follow the same path. Not because regulators enjoy making life difficult, but because the alternative is a world where critical infrastructure depends on unverifiable decisions made by systems that no one can fully trust.
What Organizations Should Do Now
No enterprise can solve the provenance challenge overnight. You cannot simply bolt another governance tool onto an AI system after it has been deployed. Provenance must be embedded across the entire lifecycle, from training and data preparation to inference and downstream actions. Still, there are practical steps you can take today.
Start with your data: A living data catalog is essential. If you cannot identify where your data is stored, how it is classified, and how it flows into your AI systems, you cannot demonstrate compliance or ensure quality.
Work from risk: Identify the decisions where AI poses the greatest operational risk. Prioritize governance there. Not every use case requires the same level of scrutiny.
Use the controls you already have: Many data security and governance tools already support lineage, classification, and monitoring. These remain valid. The challenge is extending them consistently to the entire AI layer, not replacing everything with untested solutions.
Demand transparency from vendors: Ask for training data disclosures. Ask how they track provenance internally. Ask what mechanisms they offer to trace inference data, external calls, and agent actions. Marketing assurances are not proof.
Prepare for explainability: If you cannot explain how an AI reached its conclusion, you cannot defend it during an audit or investigation. Explainability is becoming a baseline requirement, not a luxury.
The industry is beginning to converge on the idea of a unified governance fabric that spans data, models, and operational context. Data provenance will be a core part of that fabric. It is early, fragmented, and evolving quickly, but ignoring it will only make future regulatory pressure more difficult and more expensive.
AI will continue to shape digital businesses. The real question is whether it will do so transparently and responsibly or continue to rely on invisible data pipelines and unverifiable decisions. Keeping the entire chain under consistent governance is the foundation that separates reliable and trustworthy AI from slop, and it will soon be a fundamental part of compliance for every organization building or deploying AI systems.
A practical way forward begins with establishing a baseline of provenance capabilities that every enterprise can realistically implement today. At a minimum, this means knowing where your data comes from, documenting how it is cleaned, transformed, and used during model training, and maintaining enough visibility to trace which inputs and external calls influenced a particular inference.
None of this requires full interpretability or revealing a model’s internal mechanics. What it does provide is the ability to justify decisions, survive audits, and defend your AI processes when questions arise. With this foundation in place, organizations can adopt AI with more confidence while preparing for the regulatory expectations that are already taking shape.