EU AI Act Article 10 — Data and data governance
Training, validation, and testing datasets for high-risk AI must meet quality criteria and be subject to governance practices addressing bias, representativeness, and data origin
Where this comes from
Provision: Article 10 — Data and data governance
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 10, Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689 (AI Act), OJ L, 12.7.2024
Who it applies to
High-risk AI provider in scope — all of these:
- Service deploys AI systems in a professional capacity
- AI Act role is Provider or we provide some AI systems and deploy others
Annex III high-risk area (Art. 6(2)) — any one of these:
- Annex III high-risk areas includes Biometrics
- Annex III high-risk areas includes Critical infrastructure
- Annex III high-risk areas includes Education and vocational training
- Annex III high-risk areas includes Employment and worker management
- Annex III high-risk areas includes Essential public services
- Annex III high-risk areas includes Creditworthiness
- Annex III high-risk areas includes Insurance
- Annex III high-risk areas includes Law enforcement
- Annex III high-risk areas includes Migration, asylum and border control
- Annex III high-risk areas includes Administration of justice and democratic processes
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
- Art. 6(3): an Annex III system is NOT high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making — which applies where the system (a) performs... (AI Act Art. 6(3))
- Art. 10(1) binds only high-risk systems 'which make use of techniques involving the training of AI models with data'; Art. 10(6) applies a reduced set of duties (paragraphs 2, 3 and 5 only) to high-risk systems that do NOT use such techniques. (AI Act Art. 10(1) and Art. 10(6))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Art. 6(2): the AI system falls within an area listed in Annex III and is therefore high-risk, no documented Art. 6(3) derogation applying (and it is ALWAYS high-risk where it performs profiling of natural persons)
- Art. 16(a) ('Providers of high-risk AI systems shall …'), read with Art. 3(3): the actor develops the system or has it developed and places it on the market or puts it into service under its own name or trade mark — or is its authorised representative under Art. 22
- Art. 10(1): the system 'makes use of techniques involving the training of AI models with data', so training, validation and testing data sets exist to govern
What engineering work it implies
- Training Data Governance Record (Datasheet + Bias Assessment)Covers it fully
A per-dataset data card covering the Article 10(2) governance practices, plus a bias-assessment checklist and a pipeline gate that blocks a training run when the card...
Sample acceptance criteria Landfall generates for this obligation:
- Training/validation/test datasets are documented (source, scope, known gaps)
- Data-quality and representativeness checks run and are recorded
- Bias detection is performed and material findings are mitigated
- Dataset versions are tracked and linked to model/system versions
- A subgroup too small for a meaningful bias metric is reported as insufficient data, not as passing
Evidence an auditor expects
- Process recordDocument reviewRetain Art. 18(1): 10 years after the system is placed on the market or put into service
Data governance record for the training, validation and testing data sets (Art. 10(2))
Per-data-set record covering each Art. 10(2) practice: relevant design choices; data collection processes and the ORIGIN of the data (and, for personal data, the original purpose of collection); data-preparation operations (annotation, labelling, cleaning, updating, enrichment, aggregation); the assumptions formulated about what the data is meant to measure and represent; and an assessment of availability, quantity and suitability
- Assessment documentDocument reviewReviewed on each retraining or material data-set change
Bias examination and mitigation record (Art. 10(2)(f)-(g))
Documented examination of possible biases likely to affect health and safety, negatively impact fundamental rights, or lead to discrimination prohibited under Union law, together with the measures taken to prevent and mitigate them. Where special categories of personal data were processed for bias detection and correction, the Art. 10(5) conditions and safeguards must be evidenced
- Test resultsTechnical audit
Data-set quality evidence against Art. 10(3)-(4)
Evidence that data sets are relevant, sufficiently representative, and to the best extent possible free of errors and complete in view of the intended purpose, with the statistical properties and the geographical, contextual, behavioural or functional setting characteristics required by Art. 10(4)
Questions people ask
- Does EU AI Act Article 10 — Data and data governance apply to my service?
- It applies when Service deploys AI systems in a professional capacity; AI Act role is Provider or we provide some AI systems and deploy others; and at least one of: Annex III high-risk areas includes Biometrics; Annex III high-risk areas includes Critical infrastructure; Annex III high-risk areas includes Education and vocational training; Annex III high-risk areas includes Employment and worker management; Annex III high-risk areas includes Essential public services; Annex III high-risk areas includes Creditworthiness; Annex III high-risk areas includes Insurance; Annex III high-risk areas includes Law enforcement; Annex III high-risk areas includes Migration, asylum and border control; Annex III high-risk areas includes Administration of justice and democratic processes. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 10 — Data and data governance is enforceable from 2 August 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Data governance record for the training, validation and testing data sets (Art. 10(2)); Bias examination and mitigation record (Art. 10(2)(f)-(g)); Data-set quality evidence against Art. 10(3)-(4).
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.