EU AI Act Data Governance Checklist

Art. 10 is the requirement that fails quietly. Inventory your data sets, test each against the eleven Art. 10 criteria, and record the bias examination the article actually asks for.

€79 excl. VAT · one-time

Delivered by email immediately after payment. Excel file, one named user.

Article 10 is the requirement that fails quietly. The model works. The documentation exists. And nobody can say where the training data came from, or whether it represents the people the system will be used on.

What Art. 10 actually asks

Eleven things, and they are more specific than most teams expect:

the design choices for the data, documented;
collection processes and origin — and for personal data, the original purpose of collection;
preparation operations: annotation, labelling, cleaning, updating, enrichment, aggregation;
the assumptions each data set is meant to represent;
an assessment of availability, quantity and suitability;
bias examination for biases likely to affect health, safety or fundamental rights;
bias mitigation measures;
gaps and shortcomings, identified and addressable;
training, validation and test sets that are relevant, sufficiently representative, and as far as possible error-free and complete (10(3));
contextual characteristics — geographical, behavioural, functional (10(4));
and the narrow permission in 10(5) to process special-category data strictly for detecting and correcting bias, with safeguards.

What is in the file

An inventory of every training, validation and test set with its provenance and whether it holds personal data. The eleven criteria as a checklist with a state and an evidence pointer. A bias examination register — attribute examined, method, what was found, mitigation applied, residual. And a gaps tab, because 10(2)(h) asks you to identify shortcomings, not to have none.

The line that matters most

Art. 10(2)(b) asks for the origin and, where personal data is involved, the original purpose of collection. Repurposing customer data for model training is precisely where this file and your GDPR record have to agree — and where they most often do not.

What it covers in the regulation

Art. 10 — data and data governance

AI Act meets DORA and NIS2

Is your organisation subject to both the AI Act and DORA? The two regulations intersect on the operational resilience of financial AI systems. Our sister site regulation-dora.eu covers DORA in depth — including what the AI Act adds on top of an existing DORA programme.

The AI Act for financial institutions ↗ Explore regulation-dora.eu ↗

Frequently Asked Questions

What does Art. 10 require for training data?

Training, validation and testing data must be relevant, sufficiently representative, and to the best extent possible free of errors and complete in view of the intended purpose. Art. 10(2) additionally requires documented design choices, provenance, preparation operations, assumptions, a suitability assessment, bias examination and mitigation, and identified gaps.

Can we process special-category data to check for bias?

Art. 10(5) permits it strictly for the purposes of detecting and correcting bias, subject to safeguards including technical limits on re-use, state-of-the-art security, and deletion once the bias has been corrected. It is a narrow permission, not a general licence.

Do we need this if we bought the model?

You will not hold the training data, but you still need the answers — Annex IV §2(d) asks about it and your vendor is the only source. That is a due diligence and contract question.