EU AI Act Article 10: Data Governance

What Article 10 Requires

High-risk AI systems that are trained with data must be developed on the basis of training, validation and testing datasets that meet the quality criteria set out in Article 10 whenever such datasets are used.

The obligation is on the provider, and it applies to appropriate data governance and management practices across the full data lifecycle — from design choices and collection through preparation, examination and mitigation. Data governance under Article 10 is one of the requirements the Annex IV technical documentation and the Article 17 QMS must in turn describe and control.

Data Quality Criteria

Training, validation and testing datasets must be subject to data governance practices appropriate to the intended purpose, addressing in particular:

• Relevance and representativeness — datasets must be relevant, sufficiently representative, and to the best extent possible free of errors and complete in view of the intended purpose
• Appropriate statistical properties — including, where applicable, as regards the persons or groups of persons on whom the system is intended to be used
• Design choices and provenance — the relevant design assumptions, and how the data was collected, its origin and, for personal data, the original purpose of collection
• Data preparation — annotation, labelling, cleaning, updating, enrichment and aggregation operations must be documented
• Contextual coverage — the data must account for the geographical, contextual, behavioural or functional setting in which the high-risk system is intended to be used

Bias Examination, Mitigation and Data Gaps

Article 10 explicitly requires providers to look for and address bias and gaps in the data:

• Examine for biases that are likely to affect health and safety, have a negative impact on fundamental rights, or lead to prohibited discrimination — especially where outputs influence inputs for future operations (feedback loops)
• Apply appropriate mitigation measures for any biases identified during that examination
• Identify and address data gaps and shortcomings that could prevent compliance, and document how they are handled
• Document the reasoning so that bias examination and mitigation are auditable, not just performed

Special-Category Data Conditions

Article 10 permits the processing of special categories of personal data, but only to the strict extent necessary to detect and correct bias, and subject to safeguards.

That means the exception applies only when bias detection and correction cannot be effectively achieved with synthetic, anonymised or other non-special-category data. Where special-category data is used, it must be subject to appropriate safeguards for the rights and freedoms of individuals — including technical limits on re-use, state-of-the-art security and privacy-preserving measures, strict access controls and documentation, and deletion once the bias has been corrected or the data reaches the end of its retention period.

Article 10's special-category-data allowance operates alongside the GDPR, not instead of it — the GDPR's own conditions for processing special categories still apply.