For high-risk AI systems, the EU AI Act regulates the data before it regulates the model. Article 10 makes dataset governance a legal requirement: where the data came from, how it was prepared, whether it represents the people the system will judge, and what was done about bias. From 2 August 2026, a high-risk system whose training data cannot answer those questions is non-compliant regardless of how well it performs.
| Regulation | AI Act (2024/1689), Articles 10 to 12 |
|---|---|
| Applies from | 2 August 2026 (most high-risk obligations) |
| Max penalty | EUR 15M or 3% of global turnover (Art. 99(4)) |
| Enforcing authority | EU AI Office, national market surveillance authorities |
| Official text | EUR-Lex CELEX 32024R1689 |
What Article 10 demands
The article requires data governance and management practices, documented, for every training, validation, and testing set. The enumerated topics read like a data science review checklist with legal force: relevant design choices; data collection processes and the origin of data; preparation operations such as annotation, labeling, cleaning, and aggregation; an assessment of availability, quantity, and suitability; examination for possible biases likely to affect health, safety, or fundamental rights; measures to detect, prevent, and mitigate those biases; and identification of data gaps with how they were addressed.
The quality standard in Article 10(3) is deliberate: datasets shall be relevant, sufficiently representative, and to the best extent possible, free of errors and complete in view of the intended purpose. It also requires appropriate statistical properties for the persons on whom the system will be used, which is the representativeness requirement with teeth: a hiring model trained on one demographic fails it.
The bias-testing gate for sensitive data
Article 10(5) solves a real dilemma. Detecting whether a model discriminates by ethnicity or health status can require processing exactly those attributes, which GDPR Article 9 ordinarily prohibits. The AI Act creates a specific permission: special category data may be processed where strictly necessary for bias detection and correction in high-risk systems, with safeguards including technical limits on re-use, access restriction, no transmission to third parties, and deletion once the bias work is done. Use the gate as written and document each condition; it does not authorize keeping sensitive attributes around for general model improvement.
Documentation and logging make it auditable
Articles 11 and 12 convert governance into evidence. The technical documentation (Annex IV) must describe the datasets, their provenance, and the Article 10 practices, kept current for ten years after market placement. Automatic logging must capture system operation so problems can be traced. Practically, this means dataset datasheets, versioned lineage records, and bias evaluation reports are now regulatory artifacts, not just engineering hygiene.
Start with the provenance record: it is the item that cannot be reconstructed later. Then align the GDPR layer, since personal data in the same datasets needs lawful basis and retention treatment in parallel; our AI Act and GDPR overview maps the interaction, and the combined assessment guide covers the impact assessments both regimes expect.