Does Article 10 apply to fine-tuned foundation models?

Yes. If you fine-tune a foundation model for a high-risk use case, you must apply data governance practices to your fine-tuning datasets, even if you did not train the base model.

What counts as "sufficiently representative" data?

Datasets must reflect the operational context and target population of your AI system. This means covering relevant demographic groups, edge cases, and input variations your system will encounter in production.

Do I need to use synthetic data?

No, synthetic data is not mandatory. However, it can help fill identified data gaps or address underrepresentation of certain groups, particularly when real data is scarce or raises privacy concerns.

What if I use third-party datasets?

You remain responsible for ensuring third-party datasets meet Article 10 requirements. Document the dataset's provenance, conduct your own bias examination, and assess whether it is sufficiently representative for your intended purpose.

How does Article 10 interact with GDPR?

Article 10 complements GDPR by adding AI-specific data governance requirements. Article 10(5) provides a limited exception to process special-category data for bias correction, but you must still comply with GDPR's broader data protection principles.

EU AI Act Article 10: Training Data Requirements

What EU AI Act Article 10 requires for training, validation, and testing datasets — data quality, bias detection, and documentation for high-risk AI systems.

Article 10 of the EU AI Act requires providers of high-risk AI systems to apply data governance and management practices to training, validation, and testing datasets throughout the AI system lifecycle.

Data Governance Requirements

Design Choices & Data Collection

Document relevant design choices for data collection processes, including data sources, collection methods, and the rationale for dataset composition.

Data Collection Processes

Establish clear processes for gathering training, validation, and testing data that align with the intended purpose of the AI system.

Data Preparation & Annotation

Apply appropriate data preparation operations including annotation, labelling, cleaning, enrichment, and aggregation to ensure dataset quality.

Bias Examination & Mitigation

Examine datasets for possible biases that may affect health, safety, or fundamental rights, or lead to prohibited discrimination.

Data Gaps & Completeness

Identify and address data gaps or shortcomings to ensure datasets are relevant, sufficiently representative, and complete for the intended purpose.

Implementation Steps

Dataset Documentation as Code

Maintain dataset specifications, collection methods, and preparation steps in version-controlled configuration files alongside your AI system code.

Automated Bias & Drift Testing

Integrate automated bias detection and data drift tests into your CI/CD pipeline to catch issues before deployment.

Data Lineage Tracking

Implement end-to-end tracking of data sources, transformations, and versioning to maintain full visibility into dataset provenance.

Versioned Dataset Cards

Create structured dataset cards documenting composition, collection methodology, known limitations, and bias examination results for each dataset version.

GDPR Considerations

Article 10(5) permits processing of special-category personal data strictly for detecting and correcting biases, subject to appropriate safeguards including technical limitations, state-of-the-art security measures, and deletion once bias is corrected or data reaches its retention limit.

Common Questions

How Scanara Helps

Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.