Every wheel of Gruyère AOP carries a casein mark on its rind: the day it was made, the number of the wheel and the number of the dairy that made it. The mark is not optional; the AOP specification requires it on every wheel. Follow the dairy number and you reach one village cheese dairy, which takes its milk twice a day from farms no more than 20 kilometres away. Nobody has to taste the cheese to know where it came from, because the origin travels with it.
Most AI models carry nothing of the kind. Ask where a model learned what it knows, and for many systems in production today the answer is a sentence or two in a model card about publicly available and licensed data. You can still test such a model, compare its answers across groups of people and publish the gap. You cannot say why the gap is there, whether it will survive the next fine-tune, or whether anyone meant the data behind it to be used that way.
That limit ran through the Swiss Data Space Forum 2026, held on 28 October at the Unlimitrust Campus under the theme Unlocking Data for AI, as an official pre-event of the Geneva AI Summit. Two days earlier the Swiss Data Alliance had published version 1.0 of its white paper AI-ready Data, and the forum gave it a session of its own. Speakers came from cantonal and federal administration, parliament, data protection, research, industry, start-ups and open-knowledge communities. The talks we draw on came from supercomputing, statistics, consulting and the team behind Apertus, Switzerland’s fully open language model. They used different vocabularies and made one shared point: trustworthy AI is decided upstream, in the data, long before anyone measures a model.
For anyone who assesses AI, the point is practical. A fairness verdict rests on data twice over: the data a model learned from, and the data the assessment tested it on. If you can trace only one of them, your assessment covers half the system. Data spaces and trustworthy data sharing make the other half checkable.
Who this is for
This is for people who choose, buy, govern or assess AI models: heads of AI and data, risk and compliance, procurement, public-sector digital teams, and board members who will have to say whether a model is fair. Part six is a checklist you can use tomorrow.
We are not neutral. We build tools and run assessments that produce independent evidence about AI systems, and this article argues for a standard of evidence that suits what we do. We also gave some review feedback on a draft of the white paper; the paper is its authors' work. In Part five we separate what we already do from what we are sharpening.
Executive summary
Fairness starts upstream
The white paper asks that data be checked for sampling, historical, label and temporal bias before it is used. An assessment that tests only outputs can find a disparity but cannot explain it.
Readiness is relative to purpose, and so is a fairness verdict
AI-readiness is a state assessed against an intended use. A fairness verdict earned for one purpose and one population does not transfer to the next.
Openness decides what can be checked
Closed models share outputs, open-weight models share weights, and only fully open models share the data and pipelines that let you trace a behaviour back to its source. Apertus shows this is possible at national scale.
Proof has to reach the data
Our approach stays the same. We are sharpening three things we already do so that each one covers the data behind a verdict.
Part one · What the forum said
The programme was long. It ran from the Federal Data Protection and Information Commissioner, Adrian Lobsiger, to Wikimedia and Luxembourg’s National Data Service. Four contributions spoke most directly to the question this article asks, and those are the ones we draw on here.
Thomas Schulthess of the Swiss National Supercomputing Centre, where Apertus is trained on the Alps supercomputer, spoke in the morning plenary on how AI research contributes to digital sovereignty. He set out three levels of control an organisation or a country can hold over AI: protecting sensitive information, being able to understand, adapt and develop AI, and running models under its own jurisdiction. His summary line was that operating an AI model is not the same as mastering its technology. Our reading is that most organisations that say they control their AI stand on the first level. They have data-protection agreements and access rules. Far fewer stand on the second, able to look inside a model, retrain it, or know what it was trained on. Correcting unfairness needs that second level: if you cannot see or change what a model learned, you can watch its behaviour but not correct its cause. So a verdict should say which level of control it was produced under. A model you can only reach through an interface yields a different kind of evidence from one whose weights and training data were open to inspection. Both are useful, and a reader deserves to know which one they are holding.
Later in the same session Diego Kuonen of Statoo Consulting and the University of Geneva, one of the white paper’s authors, argued that AI needs better data, not just more data, and that data literacy is the condition for using either. He described trustworthy AI as resting on three complementary foundations: AI-ready data that is fit for its intended use, data literacy as an individual and organisational capability for critical understanding and informed judgement, and responsible, principles-based governance with clear responsibilities, safeguards and continual evaluation. Trustworthiness, in his account, is something an organisation demonstrates. His advice came as a sequence: think big, start small, start right, start fast. In the afternoon he led the session on the white paper and the assessment framework the working group is now building. The white paper credits him with the principle “no data literacy, no AI literacy”, and it applies to assessment directly. “No disparity detected” on a sample of two hundred means one thing to a reader who knows what statistical power is and another to a reader who does not. A finding has to say, in its reader’s language, what it could have missed.
Michael Gomez and Philipp Naber of Accenture brought the economics. Their talk on industrial data ecosystems started from an awkward observation: the technology is in place, yet adoption stays low. The main reason, they argued, is that the value potential is not visible, so network effects never start and no ecosystem reaches critical mass. Underneath sits a structural problem. The benefits concentrate at the top of a value chain, while the data has to come from the participants who benefit least and carry the highest integration costs. A data ecosystem is therefore a shared effort: concrete use cases, value shared fairly, outcomes measured and communicated, and leadership that takes responsibility for the imbalance. The same imbalance runs through AI fairness. The applicants, patients and tenants a model decides about hold the data that would show whether it treats them fairly, and they gain least from handing it over. Any system that asks them to contribute has to give something back that they can see. That is why we think the person who is decided about belongs inside an assessment.
Oleg Lavrovsky of the ETH AI Center led the afternoon workshop Insights into Apertus, and the Apertus slides shown at the forum give the most concrete picture of what traceable training data looks like at scale. Apertus is fully open: training and deployment scripts, training data pipelines, evaluation harnesses and model checkpoints are released, and a GPAI training-transparency assessment from Trinity College Dublin rates it A. It is trained only on public, versioned data. Respecting the AI opt-out preferences of authors and publishers removes about 8% of English and 4% of non-English data. Against memorisation of copyrighted text, the team uses the Goldfish objective, which leaves a pseudo-random share of tokens out of the training loss so the model cannot learn to reproduce passages word for word. Model behaviour is trained without any direct human feedback: a set of strong open-weight models judge Apertus outputs against a published charter.
Two remarks from the workshop stayed with us. Many model providers will add more checks in the coming years, and the market will have to learn to tell compliance from compliance washing. And, pointing to the work on OLMo at the Allen Institute for AI: we need to be able to trace the data to the model. A label that says “compliant” or “fair” costs nothing to print. It is worth something only when a reader can follow it back to the evidence. Apertus treats its training data the way an auditor would want any evidence treated: versioned, filtered by stated rules, and published with the code that recreates it. That is the standard we think a fairness assessment should meet about its own data.
Part two · What “AI-ready” means, and what it means for fairness
The white paper by Christine Legner, Diego Kuonen, Jingyang Wang and André Golliez, written with more than 80 members of the working group under the AI Action Plan for Switzerland, reviews over 100 sources and lands on a short definition: AI-ready data are datasets that have been documented, refined and extended to train or run AI systems designed for specific intended purposes. AI-readiness, the authors write, “is not an inherent property of a dataset, but rather a state that can be assessed in relation to its intended use.” Each of their six dimensions has a direct counterpart in how a fairness assessment should work.
| Dimension (white paper) | What it asks of data | What it means for a fairness assessment |
|---|---|---|
| Data understandability | Metadata that humans and machines can read: structure, meaning, provenance, permitted use | The test data behind a verdict is described well enough that someone else can tell what it covers and what it does not |
| FAIR principles | Findable, accessible, interoperable, reusable, with persistent identifiers | The test set can be identified and reused, so a second assessor can rerun the measurement |
| Data quality | Accurate, complete, consistent, timely; failures reported, not hidden | Rows dropped from a measurement are counted, because the dropped rows are often the minority cases |
| Volume and diversity | Enough size and spread to avoid sampling, historical, label and temporal bias | The population tested matches the population the model will decide about, group by group |
| Security, privacy, compliance | Lawful, secure, responsible use | Sensitive attributes are handled under a stated legal basis, and the assessment says where it ran |
| Function in the model | Prepared for the actual role: training, fine-tuning, retrieval, inference | A model is assessed in the role it plays, including the documents it retrieves and the data it is fine-tuned on |
Three passages read as if the authors had fairness audits in mind. On silent failure: “The most damaging issues are those that produce no error: a loading process that skips faulty records reports success, and the data appear complete.” In fairness work, records with missing fields are dropped before measurement, and those records often come disproportionately from the groups the measurement was meant to protect. On verifiability, the authors propose a test for any AI output: can one show which data it rests on, where they came from, and whether anything was received but not used? And on purpose: “A dataset is often safe for retrieval but not for training where the runtime access control boundaries are removed.” A model that behaves evenly on its base task can drift once a retrieval index or a fine-tune changes what it sees.
The use cases sharpen this. The Luxembourg legal chatbot on Legilux concludes that deletion is a first-class operation, and that the rules for what goes into a knowledge base belong to the data owner. The Samedo invoice-matching case puts it in one line: “An AI-ready output carries its evidence: source link, reference value and exact difference. A verdict without them has to be checked again.” The paper also says the coming assessment framework should “reflect maturity levels rather than a pass/fail logic”. The same holds for fairness: a binary verdict hides most of what the assessor saw.
Part three · Why data spaces matter for fairness
To assess fairness you need data most organisations do not have. To test a credit model across ages, origins or genders, you need test data in which those attributes are present, representative and lawfully held. To check whether a language model serves a Romansh speaker as well as a German speaker, you need Romansh data. Few organisations hold all of that, and those that do are rarely allowed to hand it over. Data spaces let participants share data under usage rules they set and keep enforcing. For fairness, that helps in three ways.
Shared reference data. The white paper notes that interoperability depends on reference data “maintained outside the individual dataset”. The same is true of fairness benchmarks. A credible Swiss benchmark for the country’s languages, dialects and regions cannot be built by one company, but it can be built in a commons. The Swisstopo case study in the Apertus slides, a 218 GB dataset built from free swisstopo geodata in seven documented processing steps, shows the kind of work that becomes reusable once it is shared.
Testing without handing over. Much of the data that would reveal bias is sensitive. A data space can let an assessment run against it under stated rules, so the measurement travels and the data stays where it is: the white paper’s “access instead of extraction”.
A fair return for contributors. The Accenture diagnosis applies directly: those who hold the most revealing data gain least from sharing it. The Swiss Data Alliance has proposed an inbound and outbound model for Apertus, a governance that increases data sharing while reducing the compliance burden on open models. For fairness, the return has to be concrete: evidence that the systems built on someone’s data were tested on people like them.
Part four · Openness decides what an assessment can see
One of the Apertus slides sorts model builders into three tiers. Closed models share their outputs, open-weight models their weights, fully open models their weights, data, methods, infrastructure and values. For an assessor, the tier decides what can be checked at all.
| What an assessor can do | Closed | Open-weight | Fully open |
|---|---|---|---|
| Measure outputs across groups | Yes | Yes | Yes |
| Inspect internals, attributions, representations | No | Yes | Yes |
| Rerun after fine-tuning, under your own jurisdiction | No | Yes | Yes |
| See what the model was trained on | No | No | Yes |
| Trace a behaviour back to the data that produced it | No | No | Yes |
| Reproduce the training data from published pipelines | No | No | Yes |
In Precision Is Not Proof we argued that every fairness verdict owes its reader two disclosures: what the assessment pointed at, and how well it could see, which we grade by access, evidence and validity. The forum showed us a part of the seeing we had underweighted: how much of the training data the assessor could see and trace.
Tracing has limits. Tools such as AI2’s OLMoTrace show where a model’s output matches its training data word for word, which helps with copyright and provenance but does not explain how a statistical bias formed across trillions of tokens. Someone still has to measure a traced corpus, though anyone can. As more providers attach labels to their models, ask the question Gruyère answers with a number in the rind: can I follow this claim back to its source? If you can, you hold evidence. If you cannot, you hold a description.
Part five · What we are adopting
validant.ai measures whether a system treats groups of people differently, explains what drives the difference, and proves the result in a form anyone can check. The forum does not change that approach. It sharpens three things we already do, so that each one reaches the data.
| Practice | What we do today | What we are sharpening |
|---|---|---|
| Three states | A result is fair, unfair or “not enough evidence”, and the third never counts as a pass | Records excluded from a measurement are counted and reported by group, so a clean result cannot come from removed evidence |
| Graded seeing | Every finding is graded by access, evidence and validity | The grade also covers the data: what the provider discloses about the training data, and the source, licence and version of the test data |
| Verifiable result | The verdict is a signed credential anyone can check without an account | The credential names the purpose and population it covers, and a fine-tune, a new retrieval index or new training data calls for a new assessment |
For a closed model, this means the assessment says plainly that the training data could not be seen, and grades its seeing accordingly. Our measurement library, vfairness, is free under Apache-2.0, so anyone can rerun a measurement and challenge it.
“A model can be governed without traceable data. It cannot be fully assessed without it.”
Part five · What we are adopting
Part six · How to evaluate a model now
Ask these eight questions before you choose, buy or approve an AI model. You can send most of them to a vendor in one email.
- 01Which tier is it? Closed, open-weight or fully open. It sets the ceiling on what anyone will ever be able to check.
- 02What was it trained on? Under Article 53 of the EU AI Act, providers of general-purpose AI models must publish a sufficiently detailed summary of the content used for training. Read it. If it is a sentence, treat the training data as unknown.
- 03What was the fairness result tested on? Provenance, size per group, date and licence. A result on a population unlike yours tells you little about yours.
- 04For which purpose? A verdict holds for the use it was produced for.
- 05Was anything dropped? How many records were excluded, and from which groups.
- 06What could the test have missed? The uncertainty, or the smallest disparity it could reliably detect.
- 07Has it changed since? When it was last measured, and against which version.
- 08Can someone else check it? Results only the vendor can read are an assertion. Results others can verify are evidence.
If a vendor cannot answer the first three, that is itself the most useful finding.
Part seven · What we would like, and might not get
We would like data spaces to mature, shared fairness benchmarks to appear in a commons, and fully open models to become the default for anything that decides about people. Several things stand in the way.
Adoption is slow. The Accenture speakers said it themselves: the technology is in place and adoption is not. Without a visible return for contributors, a fairness commons stays thin.
Openness competes with capability. Coverage of Apertus has been mixed: Swissinfo asked a year after launch whether it had lived up to the hype, and Le Temps defended it in an editorial against strong criticism of its quality. Many buyers will choose the strongest model over the most traceable one.
Responsible filtering shapes representation. Data removed through opt-outs comes from sites whose owners opted out, so there is no reason to assume it is a random sample. When researchers documented the C4 web corpus, they found that its blocklist filter disproportionately removed text from and about minority individuals (Dodge et al., 2021). Open pipelines let anyone measure what filtering does to representation, and someone should.
Literacy is the bottleneck. Kuonen’s point applies to all of this: better data and better evidence help only people who can read them, assessors included.
And one disclosure: nothing in this article is an assessment of Apertus. We have not measured it, and we would not publish a verdict on a model on the strength of a workshop.
Trust is assessed, not asserted. If you have to judge whether an AI model you rely on is fair, and want evidence that others can check, our closed beta is open to a small group. Write to hello@validant.ai with the subject “Closed Beta”, or request a demo. To try the open engine today: pip install vfairness.
In one line
A fairness verdict is only as trustworthy as the data beneath it can be traced; data spaces make that data shareable, open models make it visible, and we intend to make it part of every proof we issue.
Sources and further reading
- 01Legner, C., Kuonen, D., Wang, J. & Golliez, A. (2026). AI-ready Data: Conceptual Foundations, Use Cases, and Lessons Learned. White Paper of the Working Group “AI-ready Data”, AI Action Plan for Switzerland, Swiss Data Alliance. Version 1.0, 26 October 2026. Also in the University of Lausanne repository.
- 02Swiss Data Alliance. Swiss Data Space Forum 2026: Unlocking Data for AI, 28 October 2026, Unlimitrust Campus. Programme and slides.
- 03Swiss AI Initiative (2026). Trusted Data for Apertus. Slides, Swiss Data Space Forum 2026. Licensed CC BY 4.0; the comparison table in Part one is a cropped excerpt.
- 04Project Apertus (2026). Apertus: Democratizing Open and Compliant LLMs for Global Language Environments. ACL 2026. Preprint.
- 05Apertus: project website and models and datasets.
- 06Swiss Data Alliance. Apertus challenge and prototype fund.
- 07Hans, A., et al. (2024). Be like a Goldfish, Don’t Memorize! Mitigating Memorization in Generative LLMs. NeurIPS 2024.
- 08Liu, J., et al. (2025). OLMoTrace: Tracing Language Model Outputs Back to Trillions of Training Tokens. ACL 2025 System Demonstrations.
- 09Dodge, J., et al. (2021). Documenting Large Webtext Corpora: A Case Study on the Colossal Clean Crawled Corpus. EMNLP 2021.
- 10MLCommons. Croissant metadata format. Open Data Product Specification: opendataproducts.org.
- 11European Union. (2024). Regulation (EU) 2024/1689 (the AI Act). Article 53.
- 12Interprofession du Gruyère. Brochure de fabrication: the casein mark carries the production date, the wheel number and the dairy number.
- 13Federal Office for Agriculture. Gruyère: résumé de la demande d’enregistrement: a casein date mark on every wheel is mandatory; milk is delivered twice a day from a collection area of at most 20 km radius.
- 14validant.ai. vfairness on PyPI, Apache-2.0.
- 15Glinz, D. (2026). Precision Is Not Proof: The Trap in Every AI Fairness Verdict. validant.ai Signal.
- 16Glinz, D. (2026). Digital Trust Is an Orbit, Not a Pillar. validant.ai Signal.
- 17Glinz, D. (2026). Bias Is the Foundation. validant.ai Signal.
The Trust Seal turns an assessment like this into a signed record that anyone can check.
Two Views of One Decision: Trustworthy and Explainable AI in Practice at HSLU
Notes from a Lucerne specialists course on Trustworthy and Explainable AI, and what it confirms about the Validant.ai approach.
Read
The Preemptive Assurance Paradox: Who Guards the AI Guardrails?
In one September week a lab asked to slow down, a president declared himself the only guardrail AI needs, and The Economist asked whether the arms race can be stopped. Notes from Trust Valley Days 2026 at EPFL on why the answer is not a pause or a sprint, but liability, outcomes and verification.
Read
