Article 10: Data Governance for High-Risk AI
EU AI Act Article 10: quality criteria and governance practices for training, validation and testing data of high-risk AI systems, and the Article 4a rule for bias correction.
Providers of high-risk AI systems that train AI models must use training, validation and testing data sets that meet quality criteria (Article 10(1)). These data sets are subject to data governance practices, such as bias examination (Article 10(2)).
The rule applies from 2 December 2027 to Annex III systems (listed high-risk uses). For Annex I products, it applies from 2 August 2028 (Article 113(c)), except Section B (Article 2(2)). Provider fines reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: record each data set’s source and bias checks.
Article 10(2) lists eight practices, grouped here in five areas
Design choices and data origin
The practices must cover the relevant design choices, how the data was collected, where it comes from and, for personal data, why it was first collected (Article 10(2)(a) and (b)).
Data preparation
Govern annotation, labelling, cleaning, updating, enrichment and aggregation (Article 10(2)(c)).
Assumptions and suitability
State what the data is supposed to measure and represent, and assess whether enough suitable data is available (Article 10(2)(d) and (e)).
Bias examination and measures
Examine the data for biases that may harm health or safety, affect fundamental rights or lead to prohibited discrimination. Take measures to detect, prevent and mitigate them (Article 10(2)(f) and (g)).
Data gaps and shortcomings
Identify gaps or shortcomings that stop you from complying with the Act, and how to close them (Article 10(2)(h)).
If a high-risk system does not train AI models, these rules apply only to its testing data sets (Article 10(6)).
The data sets must meet three quality criteria
Relevant, representative, error-free, complete
Data sets must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete for the intended purpose (Article 10(3)).
Right statistical properties
They need appropriate statistical properties, including for the persons or groups the system is intended to be used on (Article 10(3)).
Fit to the setting
They must reflect the geographical, contextual, behavioural or functional setting of use, to the extent the intended purpose requires (Article 10(4)).
Four engineering practices that produce Article 10 evidence
Article 10 prescribes no tools. These four practices are suggestions for documenting your data governance.
Dataset documentation as code
Keep data set specifications, collection methods and preparation steps in version-controlled files next to your AI system code.
Bias and drift tests in CI/CD
Run bias checks on each data set version and data drift tests in the pipeline.
Data lineage tracking
Track sources, transformations and versions, so you can show where each data set comes from (Article 10(2)(b)).
Versioned dataset cards
Record composition, collection method, known limits and bias results for each data set version.
Article 4a allows special-category data for bias correction under strict conditions
Providers of high-risk AI systems may exceptionally process special categories of personal data when it is strictly necessary to detect and correct bias under Article 10(2), points (f) and (g) (Article 4a(1)). All conditions must be met. Among them: other data, including synthetic or anonymised data, cannot do the job; the data is under technical limits on re-use and strict access controls and is not passed to others; and it is deleted once the bias is corrected or the retention period ends. These conditions come on top of the GDPR. Article 4a(2) extends this to deployers of high-risk systems and to providers and deployers of other AI systems and models, when the processing is strictly necessary and all the Article 4a(1) conditions and safeguards apply. It creates no duty to detect or correct bias.
Article 4a was added by Regulation (EU) 2026/1744. It replaces former Article 10(5).
Common questions about Article 10
Does Article 10 apply if I fine-tune a general-purpose AI model?
Yes, for the data sets you use to train, validate and test your high-risk AI system (Article 10(1)). The Act does not say whether Article 10 also reaches the original training data of the base model. Ask counsel, and request the model information that the general-purpose AI model provider must keep for downstream providers (Article 53(1), point (b)).
What counts as “sufficiently representative” data?
Article 10(3) requires data sets to be sufficiently representative for the intended purpose and to have appropriate statistical properties, including for the persons or groups the system is used on. Article 10(4) adds the geographical, contextual, behavioural or functional setting of use. The Act sets no numeric threshold.
Do I need to use synthetic data?
No. Synthetic data is not mandatory. Article 4a(1) does require that bias detection and correction cannot be done effectively with other data, including synthetic or anonymised data, before you process special categories of personal data.
What if I use third-party data sets?
Article 10 applies to the data sets used for your system, whoever created them. Document where they come from (Article 10(2)(b)) and examine them for bias yourself (Article 10(2)(f)).
How does Article 10 interact with the GDPR?
Article 10 applies alongside the GDPR. Article 4a sets conditions for processing special categories of personal data for bias correction, in addition to the GDPR (Article 4a(1)). Article 4a(2) extends the exception to deployers and to other AI systems and models.
What fine applies if a provider breaks Article 10?
Fines for breaking the provider duties in Article 16 reach EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs and small mid-cap companies, the lower of the two amounts is the limit (Article 99(6) and (6a)).
Read next: risk management, documentation and accuracy
Article 9: risk management system
Covers the process in which bias-related risks are identified and reduced.
Article 11: technical documentation
Covers where data sets, labelling and cleaning methods are documented (Annex IV, point 2(d)).
Article 15: accuracy and robustness
Covers the accuracy, robustness and cybersecurity levels that high-risk systems must reach.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.