Art. 10: Data and data governance under the EU AI Act

Art. 10 requires the provider of a high-risk AI system that trains AI models with data to develop the system on training, validation and testing data sets that meet the quality criteria in Art. 10(2), (3) and (4) and in Art. 4a(1). In this mapping, eight elements are testable, eleven are documentation and six are process. Regulation (EU) 2026/1744 moved the Annex III application date 2027-12-02Deferred and left the content unchanged. It also deleted Art. 10(5) and placed the special-category data legal basis in Art. 4a.

Where this applies

2027-12-02DeferredAnnex III standalone high-risk obligations
2028-08-02DeferredAnnex I product-embedded high-risk obligations
2026-07-27Working readingArticle 4a (formerly Article 10(5)) legal basis for processing special-category data for bias detection and correction, necessity threshold

What the text requires

Art. 10(6) applies the criteria only to the testing data sets where the system does not train a model. The same testing data sets feed the accuracy and robustness results under Art. 15. The harms named in Art. 10(2)(f) are the harms the risk management system under Art. 9(2) identifies. A deployer who controls the input data keeps it relevant and sufficiently representative under Art. 26(4).

What the text requires and how each element is verified
Requires	Testable	Documentation	Process
Art. 10(1)A high-risk AI system that uses techniques involving the training of AI models with data is developed on the basis of training, validation and testing data sets. Those data sets meet the quality criteria in Art. 10(2), (3) and (4) and in Art. 4a(1) whenever such data sets are used. Regulation (EU) 2026/1744 replaced the former cross-reference to Art. 10(2) to (5) with this cross-reference. Art. 10(2)Training, validation and testing data sets are subject to data governance and management practices appropriate for the intended purpose of the high-risk AI system. Those practices concern in particular the matters in points (a) to (h). Art. 10(2)(a)The practices concern the relevant design choices. Art. 10(2)(b)The practices concern data collection processes and the origin of data. For personal data, the practices concern the original purpose of the data collection. Art. 10(2)(c)The practices concern relevant data-preparation processing operations, such as annotation, labelling, cleaning, updating, enrichment and aggregation. Art. 10(2)(d)The practices concern the formulation of assumptions, in particular with respect to the information that the data are supposed to measure and represent. Art. 10(2)(e)The practices concern an assessment of the availability, quantity and suitability of the data sets that are needed. Art. 10(2)(f)The practices concern examination in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law. The examination applies especially where data outputs influence inputs for future operations. Art. 10(2)(g)The practices concern appropriate measures to detect, prevent and mitigate possible biases identified according to point (f). Art. 10(2)(h)The practices concern the identification of relevant data gaps or shortcomings that prevent compliance with this Regulation, and how those gaps and shortcomings can be addressed. Art. 10(3)Training, validation and testing data sets are relevant, sufficiently representative, and to the best extent possible, free of errors and complete in view of the intended purpose. They have the appropriate statistical properties, including, where applicable, as regards the persons or groups of persons in relation to whom the high-risk AI system is intended to be used. Those characteristics may be met at the level of individual data sets or at the level of a combination of data sets. Art. 10(4)Data sets take into account, to the extent required by the intended purpose, the characteristics or elements that are particular to the specific geographical, contextual, behavioural or functional setting within which the high-risk AI system is intended to be used. Art. 10(5)Deleted by Regulation (EU) 2026/1744. The legal basis for processing special categories of personal data for bias detection and correction now sits in Art. 4a. Art. 10(6)For the development of high-risk AI systems that do not use techniques involving the training of AI models, Art. 10(2), (3) and (4) and Art. 4a(1) apply only to the testing data sets. Art. 4a(1)Providers of high-risk AI systems may exceptionally process special categories of personal data to the extent strictly necessary for bias detection and correction in accordance with Art. 10(2)(f) and (g). The processing is subject to appropriate safeguards for the fundamental rights and freedoms of natural persons. The processing meets the provisions of Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. All the conditions in points (a) to (f) are met for the processing to occur. Art. 4a(1)(a)The bias detection and correction cannot be effectively fulfilled by processing other data, including synthetic or anonymised data. Art. 4a(1)(b)The special categories of personal data are subject to technical limitations on the re-use of the personal data. They are subject to state-of-the-art security and privacy-preserving measures, including pseudonymisation. Art. 4a(1)(c)The special categories of personal data are subject to measures that keep the personal data secured and protected, with suitable safeguards. The safeguards include strict controls and documentation of the access, to avoid misuse. Only authorised persons with appropriate confidentiality obligations have access to those personal data. Art. 4a(1)(d)The special categories of personal data are not transmitted, transferred or otherwise accessed by other parties. Art. 4a(1)(e)The special categories of personal data are deleted once the bias has been corrected or the personal data has reached the end of its retention period, whichever comes first. Art. 4a(1)(f)The records of processing activities under Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 include the reasons why the processing of special categories of personal data was strictly necessary to detect and correct biases. The records include why that objective could not be achieved by processing other data. Art. 4a(2)Providers and deployers of other AI systems and models, and deployers of high-risk AI systems, may exceptionally process special categories of personal data to the extent that the processing is strictly necessary for bias detection and correction in view of the biases named in Art. 10(2)(f), and all the conditions and safeguards in Art. 4a(1) are applied. This paragraph does not create any obligation to conduct such bias detection and correction.	Representativeness of the training, validation and testing data sets against the persons or groups of persons the system is intended to be used for, measured as subgroup coverage against the declared intended purpose (Art. 10(3)) Error rate and completeness of the data sets, measured by label-error sampling and missing-value profiling against the targets the provider declares (Art. 10(3)) Statistical properties of the data sets, compared with the documented assumptions about what the data measure and represent (Art. 10(2)(d) and 10(3)) Coverage of the geographical, contextual, behavioural or functional setting of intended use in the data sets, checked against the setting declared in the intended purpose (Art. 10(4)) Bias examination result: system performance and outcomes disaggregated by protected and context-relevant subgroup, with each metric defined (Art. 10(2)(f)) Effect of the bias mitigation measures, verified by re-running the disaggregated evaluation after mitigation (Art. 10(2)(g)) Feedback-loop check where data outputs influence inputs for future operations, comparing subgroup distributions across operation cycles (Art. 10(2)(f)) Special-category data handling check: pseudonymisation and re-use limits present, access restricted to authorised persons, no transfer to other parties, observed in the data pipeline (Art. 4a(1)(b), (c) and (d))	Statement of whether the system uses techniques involving the training of AI models, which determines whether the criteria apply to all data sets or to the testing data sets only (Art. 10(1) and 10(6)) Design choices record for the data sets (Art. 10(2)(a)) Data collection and origin record, including the original purpose of collection for personal data (Art. 10(2)(b)) Data-preparation record listing the annotation, labelling, cleaning, updating, enrichment and aggregation operations (Art. 10(2)(c)) Statement of assumptions about the information the data are supposed to measure and represent (Art. 10(2)(d)) Assessment of the availability, quantity and suitability of the data sets that are needed (Art. 10(2)(e)) Record of identified data gaps or shortcomings and how they are addressed (Art. 10(2)(h)) Justification of the representativeness, error and completeness targets against the intended purpose, and a statement of whether the characteristics are met per data set or by a combination of data sets (Art. 10(3)) Record of the reasons why processing special categories of personal data was strictly necessary and why other data, including synthetic or anonymised data, could not achieve the objective, in the records of processing activities (Art. 4a(1)(a) and (f)) Access control documentation for special-category data, listing the authorised persons and their confidentiality obligations (Art. 4a(1)(c)) Retention period statement for special-category data processed for bias detection (Art. 4a(1)(e))	Data governance and management practices operated across the lifecycle for the training, validation and testing data sets (Art. 10(2)) Bias examination repeated when a data set changes and, where data outputs influence inputs for future operations, at each operation cycle (Art. 10(2)(f)) Bias detection, prevention and mitigation measures applied and maintained as identified biases change (Art. 10(2)(g)) Data gap and shortcoming identification repeated at each data set update (Art. 10(2)(h)) Deletion of special-category data at the earlier of bias correction and the end of the retention period (Art. 4a(1)(e)) Where a deployer or a provider of another AI system processes special-category data under Art. 4a(2), application of all the Art. 4a(1) conditions and safeguards to that processing (Art. 4a(2))

Metrics and where thresholds come from

Threshold sources, in order of precedence

A harmonised standard cited in the Official Journal (none as of the anchor date)
A JTC 21 draft standard (prEN), with its stage
An ISO/IEC standard or technical report, with its stage
A Commission guideline or code of practice, with its date from the standards data
NIST AI RMF or a sector framework
The state of the art, which the provider justifies and documents

Art. 10 sets no numeric threshold. It states no minimum sample size per subgroup, no maximum label error rate, no completeness level and no acceptable disparity between groups. No harmonised standard is cited in the Official Journal for this article, so the first level of the source hierarchy is empty. The sources in use today sit at the second and third levels: the JTC 21 drafts prEN 18284 and prEN 18283, both at draft stage, and ISO/IEC TR 24027:2021, a published technical report that lists candidate fairness metrics without a pass level. The provider selects the representativeness, error, completeness and disparity targets, justifies each against the context of use and the persons or groups the system is intended to be used for, and documents the justification. The metric-selection and threshold-justification step of PR-10-BIAS records that justification and its rationale.

Metric sources and their stage
Source and stage	Title	What it provides here	Verified on
`prEN 18284`Draft	Dataset quality and governance	draft data governance practices and dataset quality characteristics: the checklist for the Art. 10(2) practices and the representativeness, error and completeness characteristics of Art. 10(3)	Verified on 18 September 2026kla.digital, JTC 21 Standards Tracker (updated 29 June 2026)
`prEN 18283`Draft	Bias management	draft bias management concepts, measures and requirements: the vocabulary and candidate measures for the Art. 10(2)(f) examination and the Art. 10(2)(g) mitigation measures	Verified on 18 September 2026kla.digital, JTC 21 Standards Tracker (updated 29 June 2026)
`ISO/IEC TR 24027:2021`Published	Bias in AI systems and AI-aided decision making	bias categories, sources across the lifecycle and candidate fairness metrics for the Art. 10(2)(f) examination and for disaggregated evaluation by subgroup	Verified on 18 September 2026ISO catalogue, ISO/IEC TR 24027:2021

Procedures

Each protocol is versioned; its page states the derivation from the standards above. PR-10-BIAS v1.0 covers the eight testable elements, from the dataset quality profile to the special-category data handling check.

PR-10-BIAS v1.0Bias and subgroup performance protocolv1.0

What an assessor asks for

Dataset card for each training, validation and testing data set (Art. 10(2)(a) to (e))
Data governance and management practices description (Art. 10(2))
Dataset quality profile: representativeness, error rate, completeness and statistical properties (PR-10-BIAS output)
Bias examination report with subgroup disaggregation tables (PR-10-BIAS output)
Bias mitigation measures record with re-test results (Art. 10(2)(g))
Data gaps and shortcomings register (Art. 10(2)(h))
Bias detection legal-basis record (Art. 4a(1)(f))
Special-category data safeguards and deletion record (Art. 4a(1)(b) to (e))

Common findings

Representativeness is asserted in the technical documentation without the subgroup counts that would show it.
The bias examination covers the training set and not the validation or testing sets.
Fairness metrics are reported without their definitions or the rationale for the chosen disparity threshold.
The original purpose of collection for personal data is not recorded, so the Art. 10(2)(b) practice cannot be shown.
Special categories of personal data are processed for bias detection without a record of why other data, including synthetic or anonymised data, could not achieve the objective.
Data sets used by a system that does not train a model are treated as out of scope, although Art. 10(6) applies the criteria to the testing data sets.

Questions

What does Article 10 data governance require for bias testing?

Art. 10(2)(f) requires an examination of the training, validation and testing data sets in view of possible biases. The biases in scope are those likely to affect the health and safety of persons, have a negative impact on fundamental rights, or lead to discrimination prohibited under Union law. Art. 10(2)(g) requires appropriate measures to detect, prevent and mitigate the biases identified. The Act names no metric and no acceptable disparity. ISO/IEC TR 24027:2021 lists candidate fairness metrics. prEN 18283, at draft stage, gives bias management concepts and measures. PR-10-BIAS runs the disaggregated evaluation and records the metric selection and the threshold justification.

How does Article 10 interact with GDPR data minimisation?

Art. 10(2)(b) requires the data governance practices to cover the original purpose of collection for personal data. Art. 4a(1) permits providers of high-risk AI systems to process special categories of personal data for bias detection and correction only to the extent strictly necessary. Art. 4a(1) applies in addition to Regulation (EU) 2016/679, not in place of it. Art. 4a(1)(a) requires that the objective cannot be effectively fulfilled with other data, including synthetic or anonymised data. Art. 4a(1)(f) requires the records of processing activities to state why the processing was strictly necessary. The necessity threshold is an unsettled point shown on this page, and the working reading is strict necessity.

What does AI Act Article 10 cover?

Art. 10 covers the training, validation and testing data sets of high-risk AI systems. Art. 10(2) lists the data governance and management practices in points (a) to (h), from design choices to data gaps. Art. 10(3) requires data sets that are relevant, sufficiently representative, and to the best extent possible free of errors and complete. Art. 10(4) requires the data sets to reflect the geographical, contextual, behavioural or functional setting of intended use. Art. 10(6) applies the criteria only to the testing data sets where the system does not train a model. The legal basis for special-category data in bias detection moved to Art. 4a under Regulation (EU) 2026/1744.

What happened to AI Act Article 10(5)?

Regulation (EU) 2026/1744 deleted Art. 10(5). The same legal basis now sits in Art. 4a(1). Art. 4a(1) keeps the conditions (a) to (f) of the former Art. 10(5) for providers of high-risk AI systems. Art. 4a(2) extends the legal basis to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, under the same conditions. Art. 4a(2) creates no obligation to conduct bias detection and correction. Art. 10(1) and 10(6) now cross-refer to Art. 4a(1) instead of Art. 10(5).

What is EU AI Act Article 10, data and data governance, about?

Art. 10 carries the heading Data and data governance. It applies to providers of high-risk AI systems under Art. 6(1) and Annex I and under Art. 6(2) and Annex III. It sets quality criteria for the data sets used to develop the system. The criteria are the governance practices in Art. 10(2), the data set characteristics in Art. 10(3) and the setting-specific characteristics in Art. 10(4). The article sets no numeric threshold. Application follows the Annex III and Annex I dates recorded on the regulation entries linked on this page.

What connects to Article 10 of the AI Act?

Art. 4a(1) provides the legal basis for processing special categories of personal data for the bias examination under Art. 10(2)(f) and (g). Annex IV section 2(d) requires the technical documentation to describe the data sets, their provenance, scope and main characteristics, and the labelling and cleaning procedures. Art. 9(2)(a) requires the risk management system to identify risks to health, safety or fundamental rights, the same harms the Art. 10(2)(f) examination addresses. Art. 15 accuracy and robustness results depend on the testing data sets that Art. 10(3) and 10(4) govern. Art. 26(4) requires a deployer who controls the input data to keep that input data relevant and sufficiently representative in view of the intended purpose. Art. 72 post-market monitoring collects the operational data that can show the feedback effects named in Art. 10(2)(f).

How we test this

We test the training, validation and testing data sets against Art. 10(3) and 10(4) for representativeness, error rate, completeness and setting coverage, and we run the Art. 10(2)(f) bias examination disaggregated by subgroup. We verify the Art. 4a(1) safeguards in the data pipeline and prepare the evidence an assessor asks for; the scope limits are stated on what we cannot do.

Bias and fairness testing under the Omnibus sensitive-data provisionPR-10-BIAS
Pre-conformity mock assessmentPR-43-MOCK
Data governance and dataset quality testingPR-10-BIAS

What we cannot do

We do not perform conformity assessments where a notified body is required.
We do not issue CE marking or the EU Declaration of Conformity.
We are not a notified body.
We do not give legal opinions on classification or liability.
We test against requirements, prepare evidence, and structure documentation; compliance decisions remain with the provider or deployer, their notified body, and their counsel.

Read the full statement