EU AI Act Article 10 — Data and data governance
Providers of high-risk AI systems must ensure that covered datasets meet applicable quality and governance requirements; non-training systems are covered for testing datasets
Where this comes from
Provision: Article 10 — Data and data governance
Instrument: EU Artificial Intelligence Act (Regulation (EU) 2024/1689)
Citation: Article 10, Regulation (EU) 2024/1689
Text version: Regulation (EU) 2024/1689, Articles 10 and 113 as amended by Regulation (EU) 2026/1744
Who it applies to
High-risk AI provider in scope — all of these:
- Article 10 assessed high-risk classification: YES
- AI Act role is Provider or we provide some AI systems and deploy others
…unless:
- AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development
- Art. 2(3): the Regulation 'does not apply to AI systems where and in so far as they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes'. (AI Act Art. 2(3))
- Art. 2(6): the Regulation 'does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development'. (AI Act Art. 2(6))
- Art. 6(3): an Annex III system is NOT high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making — which applies where the system (a) performs... (AI Act Art. 6(3))
Scope in the source's own terms
- Art. 2(1): the AI system is placed on the market or put into service in the Union, or the provider/deployer is established in the Union, or the output produced by the system is used in the Union
- Assess Article 6(1), including paragraphs 1a-1c and Article 2(2) sectoral treatment, or Article 6(2)/Annex III with Article 6(3). A broad sector answer alone does not establish high-risk classification.
- Article 16(a): this duty belongs to providers. Authorised representatives have separate Article 22 duties; representative status alone does not make them providers.
What engineering work it implies
- Training Data Governance Record (Datasheet + Bias Assessment)Covers it fully
A per-dataset data card covering the Article 10(2) governance practices, plus a bias-assessment checklist and a pipeline gate that blocks a training run when the card...
Sample acceptance criteria Landfall generates for this obligation:
- Training/validation/test datasets are documented (source, scope, known gaps)
- Data-quality and representativeness checks run and are recorded
- Bias detection is performed and material findings are mitigated
- Dataset versions are tracked and linked to model/system versions
- A subgroup too small for a meaningful bias metric is reported as insufficient data, not as passing
Evidence an auditor expects
- Process recordDocument reviewRetain Apply Art. 18(1) to documentation within its scope: 10 years after placing on the market or putting into service. This is not blanket retention of underlying datasets or personal data.
Data governance record for the training, validation and testing data sets (Art. 10(2))
Per-data-set record covering each Art. 10(2) practice: relevant design choices; data collection processes and the ORIGIN of the data (and, for personal data, the original purpose of collection); data-preparation operations (annotation, labelling, cleaning, updating, enrichment, aggregation); the assumptions formulated about what the data is meant to measure and represent; an assessment of availability, quantity and suitability; examination, prevention and mitigation of relevant biases; and identification and treatment of relevant data gaps
- Assessment documentDocument reviewReviewed Suggested internal control: review on retraining or material dataset change
Bias examination and mitigation record (Art. 10(2)(f)-(g))
Documented examination of possible biases likely to affect health and safety, negatively impact fundamental rights, or lead to discrimination prohibited under Union law, together with the measures taken to prevent and mitigate them. Where special categories of personal data were processed for bias detection and correction, the Art. 4a(1) conditions and safeguards (following Regulation (EU) 2026/1744) must be evidenced
- Test resultsTechnical audit
Data-set quality evidence against Art. 10(3)-(4)
Evidence that data sets are relevant, sufficiently representative, and to the best extent possible free of errors and complete in view of the intended purpose, with the statistical properties and the geographical, contextual, behavioural or functional setting characteristics required by Art. 10(4)
Questions people ask
- Does EU AI Act Article 10 — Data and data governance apply to my service?
- It applies when Article 10 assessed high-risk classification: YES; AI Act role is Provider or we provide some AI systems and deploy others. It does not apply where AI Act scope exclusion is used exclusively for military, defence or national-security purposes or developed and used solely for scientific research and development.
- When does this become enforceable?
- EU AI Act Article 10 — Data and data governance is enforceable from 2 December 2027. Its current status is: passed, not yet in force.
- What evidence does an auditor expect?
- Data governance record for the training, validation and testing data sets (Art. 10(2)); Bias examination and mitigation record (Art. 10(2)(f)-(g)); Data-set quality evidence against Art. 10(3)-(4).
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.