Keep data preparation and permission decisions explicit. A customer export, publicly accessible record or teacher-generated example is not automatically authorised for every use.
- □ Record sources, customer/tenant, sensitivity, provenance, retention and intended processing.
- □ Check customer contracts, supplier reuse, subcontractors and model/teacher licences.
- □ Define label instructions and adjudicate ambiguous cases with domain reviewers.
- □ Separate related customers, layouts, conversations or time periods as the task requires.
- □ Restrict access to final holdout answers and keep a versioned split manifest.
- □ Define deterministic checks, human review and how any model grader is calibrated.
GroupKFold and TimeSeriesSplit document useful split mechanisms, but neither selects the business generalisation question or detects every semantic duplicate. Anthropic’s evaluation guidance provides context for combining grader types. The practical requirement is an evaluation that measures the intended deployment and cannot be improved merely by seeing its answers.
For health information, resolve the actual covered-entity/business-associate relationship and required agreements before transfer; HHS cloud guidance explains why encryption alone does not settle those obligations. Broader legal applicability depends on the use and jurisdictions. Use the regulatory document to identify issues for counsel rather than declaring the project compliant from a checklist.