HighProvenance◐Demonstrated
Training-data provenance & licensing gaps
Data & Input IntegrityDescription
Unknown or unlicensed provenance of training data creates legal exposure and prevents defensible governance of what the model learned.
Example scenario
The bank cannot evidence the licensing basis of a third-party model's training data during a regulatory audit.
Real-world evidence◐Demonstrated
Robo-advisors have drawn SEC and FINRA scrutiny for suitability failures and inadequate risk profiling, and AI chatbots such as Air Canada's were found in court to have made false policy commitments leading to financial loss. However, a documented mass-harm production incident where an LLM-based adviser systematically mis-sold regulated products at scale has not yet been publicly confirmed.
Primary mitigations
- Data lineage records
- licence/consent registers
- provenance attestations from model vendors
- SBOM-style data bills of materials.
Detection signals
Provenance-coverage metric; licence-audit exceptions; missing-lineage flags.
Mitigating controls
5 Non-agentic controls
ZYC-ACCU-001Non-Agentic
Lexical Similarity
Accuracy
ZYC-ROB-001Non-Agentic
Out-of-Distribution Detection
Robustness
ZYC-SCV-001Non-Agentic
Third-Party component risk
Supply Chain Vulnerabilities
ZYC-PRIV-001Non-Agentic
PII Detection and Classification
Privacy & Data Governance
ZYC-SCV-004Non-Agentic
Data Provenance
Supply Chain Vulnerabilities