Article 4a: the legal basis for special-category data in bias detection after the Omnibus

What the source says

Art. 4a(1) of the consolidated text opens with the threshold. Providers of high-risk AI systems may exceptionally process special categories of personal data to the extent strictly necessary for bias detection and correction in accordance with Art. 10(2), points (f) and (g). The processing is subject to appropriate safeguards for the fundamental rights and freedoms of natural persons, and the conditions apply in addition to the provisions of Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. The basis is tied to the examination in view of possible biases under Art. 10(2)(f) and to the measures that detect, prevent and mitigate those biases under Art. 10(2)(g). The Art. 10 obligation page restates each point and shows where Art. 10(1) and Art. 10(6) now cross-refer to Art. 4a(1) in place of the deleted paragraph.

The text then lists the conditions. The processing may occur only where all of them are met, so each condition needs its own record.

Art. 4a(2) extends the basis beyond providers of high-risk systems. Providers and deployers of other AI systems and models, and deployers of high-risk AI systems, may exceptionally process special categories of personal data to the extent strictly necessary for bias detection and correction in view of the biases named in Art. 10(2)(f), with all the conditions and safeguards of Art. 4a(1) applied. The same paragraph states that it creates no obligation to conduct such bias detection and correction.

On the data protection side, Art. 9(1) of Regulation (EU) 2016/679 prohibits the processing of special categories and Art. 9(2)(a) to (j) lists the exceptions. Art. 4a(1) is a permission under the Act, and its own wording places its conditions in addition to the provisions of Regulation (EU) 2016/679. A data flow with special-category data therefore carries an Art. 9(2) condition on the GDPR side and an Art. 4a(1) record on the Act side, and a record under one regulation does not discharge the other; the EU AI Act vs GDPR guide sets the two provisions side by side. The height of the necessity threshold is an unsettled point: the Commission's Omnibus proposal used plain necessity, and the enacted text reads "strictly necessary". Both readings and their sources are recorded below, with the working reading marked.

What changes for a provider or deployer

The content of the six conditions is the same as in the former Art. 10(5); the location and the timing changed. Art. 4a sits in Chapter I of the Act, and the entry above records its application from the Omnibus entry into force. The Art. 10 obligations sit in Chapter III, and amended Art. 113(c) applies Chapter III to Annex III systems from a later date 2027-12-02Deferred. A provider that runs the Art. 10(2)(f) examination before that date relies on the Art. 4a basis now and holds the records now.

The obligation record splits Art. 4a into one testable element, the special-category data handling check under Art. 4a(1)(b), (c) and (d), observed in the pipeline; three documentation elements, the reasons record under (a) and (f), the access control documentation under (c) and the retention period statement under (e); and two process elements, deletion at the earlier of bias correction and the end of the retention period under (e), and application of the full condition set by a deployer under Art. 4a(2). PR-10-BIAS v1.0 carries the Art. 4a steps on the protocol page: the presence statement, the legal-basis input set, the safeguards observations under (b) to (d), the legal-basis review under (a) and (f), and the retention and deletion check under (e). The observed results under (b) to (d) sit in the test report as results per testable element; the assembled outputs are the two artifacts the obligation record names: the bias detection legal-basis record, and the special-category data safeguards and deletion record.

The bias and fairness service lists the documentation of the legal basis and the safeguards applied as an itemised deliverable next to the subgroup disaggregation tables; the scope is on the service page. The common findings on the obligation record include the case where special categories are processed for bias detection without a statement of why other data, including synthetic or anonymised data, could not achieve the objective. The Act names no fairness metric and no acceptable disparity for the examination itself. Candidate metrics come from ISO/IEC TR 24027:2021Published, a published technical report, and bias measures from prEN 18283Draft, at draft stage; the provider selects the targets and the threshold-justification step of the protocol records the justification.

What to do now

1. Record whether special categories of personal data are present in any data set or pipeline stage, under Art. 4a(1); the presence statement is the first Art. 4a step of the protocol.
2. Where they are present, write the reasons under Art. 4a(1)(a) and (f) into the Art. 30 record of processing activities under Regulation (EU) 2016/679, including why synthetic or anonymised data could not achieve the objective.
3. Configure and document the safeguards under Art. 4a(1)(b) to (d): pseudonymisation and re-use limits, the list of authorised persons with their confidentiality obligations, and the egress controls that block transfer.
4. State the retention period and the deletion trigger under Art. 4a(1)(e).
5. Define the subgroups and the metrics for the Art. 10(2)(f) examination with the subgroup disaggregation guide, and record the threshold justification before the run.
6. A deployer under Art. 4a(2) applies the same six conditions to its own processing; the paragraph creates no duty to run the examination, so the decision to run it is recorded with its reason.

Related pages

The obligation page, the protocol, the two guides, the services and the ICP hubs this post draws on are listed below.

Obligations

• Art. 10

Protocols

• PR-10-BIAS v1.0

Guides

• AI bias testing for fairness under the EU AI Act: subgroup disaggregation
• EU AI Act vs GDPR: differences and overlap

Services

• Bias and fairness testing under the Omnibus sensitive-data provision
• Data governance and dataset quality testing

ICP hubs

• Annex III providers
• Deployers

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com