Data Governance Requirements in EU AI Act Article 10

Article 10 applies to providers of high-risk AI systems that use data to train models with those systems, including validation and testing. It does not impose one universal dataset recipe. Governance practices must be appropriate to intended purpose and examine design choices, data collection, origin, preparation, assumptions, and availability. Providers should check data fit and missing relevant populations or conditions.

The Act identifies quality dimensions such as relevance, representativeness, completeness, and errors. Data should be examined in light of the context and purpose for which the system is intended. Where applicable, providers must assess possible biases likely to affect health and safety or fundamental rights, especially where outputs influence inputs for future operations. Appropriate measures should detect, prevent, and mitigate those biases. The July 2026 Digital Omnibus moved the high-risk-provider rule formerly in Article 10(5) into Article 4a and extended a strictly necessary, safeguarded exception to providers and deployers of other AI systems and models and to deployers of high-risk systems. It applies only to bias detection and correction under the Act’s conditions, including using other data where they can achieve the purpose; this is not general permission to collect sensitive data.

Article 10 is a provider requirement. Deployers have separate duties, including ensuring input data under their control are relevant and sufficiently representative for the intended purpose. A deployer should not assume the vendor’s training-data process guarantees that local inputs, sensors, or user population fit the system. Nor does dataset documentation alone establish lawful data processing, statistical fairness, or good performance in every subgroup.

Teams should maintain a dataset record that connects source, collection method, selection and exclusions, labels, transformations, intended population, and known limitations to specific tests. Define how quality was measured, which groups and conditions were evaluated, and what mitigation changed. Retest after material changes to data, model, or purpose. Document residual limits clearly for deployers, who need enough information to use the system responsibly.