A dataset card is the README file in a dataset repository that explains what the data is, where it came from and how to use it responsibly. For supply chain review, read the license, language, size and bias notes, then record them next to the exact dataset version you trained on.
What a dataset card is
On the Hugging Face Hub, each dataset can be documented by a README.md file, called a dataset card. The Hub renders it on the dataset's main page. Its purpose, in the Hub's words, is to help users understand the contents of the dataset and give context for how it should be used. It also suggests documenting potential biases.
The card has two layers. The first is free text. The second is a YAML block at the top, called metadata, holding fields such as license, language, size, tags and task categories. The metadata is what makes datasets searchable and filterable on the Hub.
Fields to read first
| Field or section | Why a reviewer cares |
|---|---|
| license | Decides whether you may train on it and ship the result |
| language | Confirms the data fits your use case |
| task_categories and tags | Shows what the dataset was built for |
| pretty_name | Helps you name it correctly in your inventory |
| Bias and limitations notes | Flags known problems before they reach your model |
| Paper link | Gives you a primary source to check claims against |
The Hub notes that if you choose a license using its listed identifiers, the license is displayed on the dataset page. If the field is blank or vague, treat the license as unknown, not as permissive.
Steps for a review
- Open the card and the file list. Note the commit you are looking at.
- Read the license field. If it says other, find the license text in the repository.
- Read what the card says about collection and known biases. If the section is empty, that is information too.
- Follow the paper link, if there is one, and check that the card matches it.
- Write down the dataset identifier, the revision, the license and the date you reviewed it.
- Re-check when the dataset updates. A card can change after you read it.
What a card does not tell you
A dataset card is written by the publisher. It is a claim, not an audit. It does not prove the data is clean, that nobody tampered with it, or that the license is correctly applied to every row. For sensitive projects, sample the data yourself, and keep a copy of the exact version you used so you can answer questions later.
This matters for AI bills of materials too. A record of a model is stronger when it points to the datasets behind it with a version and a license. For what to record per model, see what goes in an ML BOM for a model.
Quick check
Is a dataset card required on the Hub?
The Hub describes it as a good idea, not a legal duty. That is why many cards are thin, and why you should record what you find, including gaps.
Does a license in the card metadata settle commercial use?
It tells you what the publisher declared. For anything that matters, read the license text itself and ask counsel, since the card is not legal advice.
Safeguard scans repository dependencies and generates SBOMs, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
