What data and data governance does Article 10 require?

Which systems does Article 10 cover?

Article 10 applies in full to high-risk AI systems developed using techniques involving the training of AI models. For high-risk systems developed without such techniques, the dataset requirements apply to testing data, as the article provides. The distinction matters for scoping: a team should first record whether model training is involved, which datasets are used for training, validation and testing, and which datasets are testing-only. That scoping note should sit at the front of the data governance file, so that a reviewer can see why a particular dataset was included or excluded. A file that applies every dataset requirement to every data artefact, without scoping, will be difficult to audit, while a file that omits a training dataset because it was not labelled as such will be incomplete.

What data governance practices are expected?

Article 10 requires data governance and management practices that address, in outline, design choices, data collection processes and origin, relevant data preparation operations, assumptions about what the data represent, assessment of data availability and suitability, examination for bias, and measures to detect, prevent and mitigate bias. Those practices should be documented as a coherent method, not as a set of disconnected notes. For each dataset, the file should record origin, collection method, preparation steps, labelling approach, and any known limitation. Assumptions should be stated explicitly, because an assumption about what data represent is often where a later failure originates. The governance file should be versioned with the datasets it describes, so that a dataset change triggers a governance review.

For the broader regulatory framework, see High-risk requirements overview.

What quality criteria apply to datasets?

Training, validation and testing datasets must be relevant, sufficiently representative, and as free of errors and as complete as possible, in view of the intended purpose. Relevance means the data bear on the task and context the system will face. Representativeness means the data reflect the population, geography and conditions of the intended deployment, including groups that may be affected differently. Freedom from errors and completeness are judged as far as possible, recognising that no dataset is perfect, and the provider should record the checks performed, the errors found, and the remediation taken. The criteria should be applied to each dataset separately, because a training set can be representative while a testing set is not, and the testing set is what validates the claim about performance.

How should bias be examined?

Datasets must be examined for possible bias that could lead to discrimination or to harm to fundamental rights, and appropriate measures must be taken to detect, prevent and mitigate bias, in accordance with Article 10(2)(f) and (g). Bias examination should look at representation, labelling, historical patterns in the data, and performance differences across affected groups, using methods that are documented and proportionate. The examination should be carried out before deployment and revisited during the lifecycle, because bias can emerge as data, populations or deployment contexts change. Findings, measures taken, and residual concerns should be recorded and linked to the risk management file, so that a bias finding is not isolated from the risk measures that are supposed to address it.

What does Article 4a allow for special categories of data?

Article 4a, inserted by Regulation (EU) 2026/1744, permits providers of high-risk systems to process special categories of personal data exceptionally, to the extent strictly necessary for bias detection and correction in accordance with Article 10(2)(f) and (g), subject to appropriate safeguards and to cumulative conditions. Those conditions include, in outline, that the objective cannot be effectively fulfilled by other data including synthetic or anonymised data, that technical limits on reuse and state-of-the-art security and privacy-preserving measures including pseudonymisation apply, that access is strictly controlled and documented, that the data are not transmitted to other parties, and that the data are deleted once the bias has been corrected or the retention period ends, with the processing record stating why the processing was strictly necessary. Article 4a(2) extends a similar permission, under the same safeguards and additional conditions, to providers and deployers of other systems and models and to deployers of high-risk systems where strictly necessary to address biases affecting health and safety, fundamental rights or prohibited discrimination. Article 4a is a permission, not a duty to collect such data, and it does not displace data protection law. Older material that places this permission in Article 10(5) is outdated, because Regulation (EU) 2026/1744 deleted that paragraph.

Continue with Bias detection and correction for high-risk systems.

What does this guide not decide?

This guide does not decide whether a particular dataset meets Article 10, whether a bias examination is sufficient, or whether Article 4a conditions are met for a specific processing operation. It does not set a representativeness threshold, approve a bias method, or determine a data protection law basis. Those questions depend on the datasets, the intended purpose, the affected groups, the safeguards in place, and the consolidated legal text together with data protection law. A provider should confirm its data governance and Article 4a position with a competent authority or legal adviser, document the necessity assessment and safeguards, and keep the file under review as data and deployment change.

Frequently asked questions

Continue through this AI Act cluster

• High-risk requirements overview
• Bias detection and correction for high-risk systems
• Article 9 risk management for high-risk systems
• High-risk AI systems
• Provider responsibilities
• What technical documentation does Article 11 require?