Regulatory compliance-readiness in the AI Supply Chain: examining datasets in Hugging Face

Abstract: A very large number of datasets are made available via Hugging Face (HF). These datasets are used to train a vast number of AI models, also available via HF. There are regulatory issues that might arise in the AI supply chain when those datasets do not follow, for instance, data privacy practices, or do not disclose their data sources, cleaning and preparation processes. In this preliminary work, regulatory compliance-readiness is examined as a quality attribute in the framework of HF datasets, with a main focus on data privacy (e.g. GDPR, CCPA). Towards this direction, an analysis on regulatory compliance (e.g. with privacy laws) of the dataset using the dataset card and the dataset structure overview as starting points has been performed. We collected 11,682 HF datasets that have a dataset card, are not gated and have at least 500 downloads and analyzed the datasets using automated techniques and manual analysis on a sample of the dataset. The results show that a very small number of datasets are explicit on the datasets creation processes and mention data sources, while some make mentions to Personally Identifiable Information (PII) or other sensitive data in their data schemas. These results show the need for more detailed examinations of regulatory compliance in AI datasets and models, and research on tools that provide guidance to practitioners and automate the compliance process.

• The paper identifies significant documentation deficits that jeopardize compliance-readiness, with less than 3.5% of datasets including explicit provenance details.
• The paper employs both automated and manual analysis of over 11,000 datasets to uncover sparse privacy preservation techniques and minimal risk disclosures.
• The paper highlights that scant regulatory text references and PII detections underscore an urgent need for improved platform-level compliance standards.

Regulatory Compliance-Readiness in the AI Supply Chain: An Examination of Hugging Face Datasets

Introduction

"Regulatory compliance-readiness in the AI Supply Chain: examining datasets in Hugging Face" (2607.03310) provides a systematic assessment of regulatory compliance attributes, focusing on privacy law adherence, within the landscape of open datasets on Hugging Face (HF). The analysis targets both the explicitness of dataset metadata in documenting provenance, processing, and privacy-preserving practices, as well as the presence of direct risks through the inclusion of PII and sensitive data. Leveraging over 11,000 HF datasets with significant usage (over 500 downloads, not gated, with present dataset cards), the work provides both an automated and manual investigation into the state of transparency and legal compliance-related documentation. This analysis is contextualized amid the tightening regulatory landscape, such as GDPR, CCPA, LGPD, PIPL, and the phased-in enforcement of the EU AI Act.

Context and Related Work

Prior research has primarily focused on HF models' licensing and bias reporting [stalnakerempirical, pepe2024hugging], dataset and model linkage [rahman2025hugginggraph], and general dataset documentation structure [yang2023navigating]. However, systematic examinations of regulatory compliance readiness at the dataset level have largely been addressed only in restricted domains such as healthcare and biometrics [mittal2024responsible], rather than in general-purpose model training sets. Existing tools and frameworks—such as emerging AI Bill of Materials (AIBOM) standards [bennet2025implementing, d2025aloha], traceability solutions [longpre2024large], and privacy/PII identification models [haleluyah2025towards, yang2025understanding]—further exemplify the nascent but crucial demand for automated compliance tracking. The present work extends this trajectory by scrutinizing documentation granularity and privacy measures within one of the most influential open AI dataset repositories.

Regulatory Landscape for AI Datasets

Current data privacy laws impose detailed requirements regarding data subject rights and data processing transparency (GDPR, CCPA, LGPD) and, increasingly, domain-specific stipulations (BIPA for biometrics, PIPA for South Korea, PIPL for China). The EU AI Act defines explicit mandates for dataset governance—including the necessity for provenance, representativeness, error minimization, and documented legal basis for personal data usage. However, there is latency between legislative passage and sectoral adoption of standardized compliance reporting, particularly in decentralized repositories such as Hugging Face.

Methodological Overview

The analysis targets 11,682 HF datasets selected for impact and accessibility. Datasets are filtered for download count, exclusion of gated (restricted) access, and presence of non-empty dataset cards. Automated parsing focuses on standardized card sections ("Source Data," "Annotations," "Initial Data Collection"), explicit privacy preservation mechanisms (e.g., synthetic data, anonymization, differential privacy), mention of applicable legal frameworks (GDPR, AI Act, CCPA, etc.), and schema-level keywords indicative of PII/sensitive data (e.g., "username," "email," "gender"). Where possible, data schemas are obtained to examine column names for direct compliance violations. Manual validation is conducted on statistically robust samples to disambiguate surface-level false positives.

Empirical Findings

Completeness and Transparency of Provenance

Only 3.47% of datasets provide explicit "Source Data" sections, and detailed annotation or data cleaning documentation are less common (~3%). Among these, references to external datasets, public web corpora (e.g., CommonCrawl, Wikipedia, arXiv), and sometimes only indirect references to otherwise opaque sources are pervasive. The reliance on external publications rather than in-metadata documentation further fragments the audit trail, impeding compliance assessment.

Prevalence of Privacy-Preserving Practices

Mentions of privacy-preserving techniques are present in 11.21% of datasets. The dominant approaches are synthetic data generation (4.55%), anonymization (2.11%), and aggregation (2.04%). However, direct references to modern PII/PHI scrubbing tools (e.g., Microsoft Presidio, Nemotron-PII) are extremely rare (<0.2%). Differential privacy, pseudonymization, and redaction are even less cited, and multi-pronged approaches are virtually non-existent.

Explicit Regulatory Compliance Mentions

Less than 0.3% of dataset cards reference specific regulatory texts, mainly limited to GDPR (22 datasets), the EU AI Act (9), HIPAA (7), and CCPA (5). Most provide only generic statements about compliance without linkage to process or evidence.

Detection of PII and Sensitive Data

Schema extraction permitted analysis of 7,730 datasets. Among these, 2.37% (277 datasets) contained column names directly referencing PII/sensitive concepts (e.g., "author," "gender," "age," "username," "email"). Manual inspection on a representative sample revealed a precision of 0.51 for automated detection, indicating that at least 1.8% of datasets with available schema do indeed include inadequately redacted sensitive data, including identified usernames and images where provenance and consent are ambiguous.

Risk and Limitation Disclosure

Despite the presence of a standardized "Bias, Risks, and Limitations" section in the HF dataset card schema, only 6.81% utilize this section, and among reviewed samples, substantive risk disclosure (including privacy risk) is virtually absent.

Implications for the AI Supply Chain

For Research

There is a pronounced gap between regulatory requirements and dataset documentation practice, demanding further research into tools for automated compliance vetting, especially for chaining and tracing model-dataset dependency graphs. More granular linkage of provenance chains and integration of consent metadata are critical for next-generation AIBOM solutions.

For Practitioners

Dataset developers and model trainers must augment documentation, particularly regarding data lineage and privacy impact. If no standardized documentation exists for provenance and privacy-preservation practices, legal and reputational risk is concentrated downstream as models built on such data are increasingly subject to regulatory scrutiny.

For Platforms and Regulators

The Hugging Face platform—and analogous dataset/model clearinghouses—require stricter schema enforcement, prompt engineering for metadata completion, and automated PII detection at upload. Platform-embedded compliance checklists and reference implementations for scrubbing are warranted.

Limitations

The analysis is constrained to datasets meeting HF-accessibility and schema-extraction criteria. Datasets with only external or non-standard documentation may be underrepresented. Moreover, the keyword-based identification of PII is an imperfect proxy for actual privacy risk and may under or overreport depending on dataset-specific conventions.

Conclusion

Most high-impact HF datasets are not currently compliance-ready, with sparse in-metadata documentation of data provenance and privacy-preserving measures. Direct inclusion of PII and sensitive data, coupled with lack of regulatory references and minimal risk disclosure, points to an urgent need for platform-level standards and developer guidance on regulatory compliance. Theoretical implications include amplified legal risk and difficulties in establishing transparency for AI models’ supply chain. Only substantial improvements in dataset documentation, platform affordances, and compliance automation will ensure sustainable, lawful, and trustworthy AI development in regulated contexts.