AG-816
Indigenous Data Sovereignty and CARE Principles
EU AI Act
NIST AI RMF
ISO 42001
AGS Rights & Public Interest | Rights, Ethics & Public Interest | Version 2.2
Indigenous Data Sovereignty and CARE Principles governs the use by AI agents of data relating to Indigenous peoples — requiring respect for Indigenous authority to control such data, consent and benefit aligned to the CARE principles (Collective benefit, Authority to control, Responsibility, Ethics), and the right of Indigenous communities to refuse or condition AI use of their data and knowledge.
Where FAIR principles address data being findable and reusable, CARE addresses *whose data it is and who decides* — recognising Indigenous peoples' rights of self-determination over data about their communities, lands, and knowledge. This dimension brings agentic data use under that discipline.
In scope: AI use of data about Indigenous peoples, lands, languages, and traditional knowledge; consent/authority, collective benefit, and refusal rights; provenance and governance of such data through the agent's pipeline.
Out of scope: general data protection (covered by Privacy landscapes) where Indigenous-specific rights do not apply. This dimension governs *Indigenous data sovereignty specifically*.
AI systems can extract, aggregate, and exploit Indigenous data and knowledge without consent or benefit to the communities concerned — repeating historical harms at scale and violating self-determination. Traditional consent and IP frameworks often fail to recognise collective Indigenous rights. Embedding CARE-aligned authority, consent, benefit, and refusal into agent data governance prevents extractive use and respects recognised rights.
Test 6.1: Authority & Consent
Test 6.2: Refusal & Withdrawal
Test 6.3: Provenance Carry
| Score | Criteria |
|---|---|
| 0 | Indigenous data used by agents with no CARE-aligned governance |
| 1 | CARE acknowledged; identification exists but consent/refusal not operationalised |
| 2 | Authority/consent tracked, refusal/withdrawal honoured, provenance carried, stakeholders engaged |
| 3 | Documented collective benefit, enforced cultural-use restrictions, end-to-end CARE governance with records |
Scenario A — Extractive Training: An agent's knowledge base ingests traditional knowledge scraped from public sources without community authority, then commercialises outputs derived from it. CARE authority/consent governance would have prevented unauthorised use.
Scenario B — Ignored Withdrawal: A community withdraws consent, but the data persists in the agent's memory/embeddings and continues to shape outputs. Withdrawal-honouring removal would have respected the decision.
Scenario C — Lost Conditions: Indigenous data supplied under cultural-use conditions is passed downstream without those conditions, and outputs breach a sensitivity restriction. Provenance carrying the conditions would have constrained the outputs.
| Requirement | EU AI Act | NIST AI RMF | ISO 42001 |
|---|---|---|---|
| R1: Identify Indigenous-related data | Art. 10 — Data governance | MAP 1.1 — Purpose and context | A.7 — Data for AI systems |
| R2: Authority/consent | Art. 10 — Data governance | GOVERN 5.1 — External feedback | A.7 — Data for AI systems |
| R3: Refusal/withdrawal honoured | Art. 10 — Data governance | GOVERN 5.2 — Feedback into design | A.5 — Impact assessment |
| R4: Collective benefit | Art. 27 — Fundamental-rights impact | MAP 5.1 — Impact identification | A.5 — Impact assessment |
| R5: Provenance carry | Art. 10 — Data governance/lineage | MEASURE 2.8 — Transparency | A.7 — Data for AI systems |
| R6: Cultural-use restrictions on outputs | Art. 27 — Fundamental-rights impact | MAP 5.1 — Impact identification | A.5 — Impact assessment |
| R7: Stakeholder engagement | Art. 27 — FRIA stakeholder input | GOVERN 5.1 — External feedback | Clause 4.2 — Interested parties |
| R8: Consent/decision records | Art. 12 — Record-keeping | GOVERN 2.1 — Accountability | Clause 7.5 — Documented information |
Article 10 (data governance) requires appropriate governance of data sources and conditions; Article 27 (fundamental-rights impact assessment) covers impacts on rights-holders, including Indigenous self-determination. AG-816 applies these to Indigenous data via CARE.
MAP 1.1 (purpose/context, incl. norms) and GOVERN 5.1 (collecting and integrating external stakeholder feedback) support CARE-aligned authority and engagement.
Annex A.5 (assessing impacts on individuals/groups/society) and A.7 (data for AI systems) require governing the impacts and provenance of Indigenous data.