Data governance
Article 10 requires that training, validation and test datasets for high-risk AI are relevant, sufficiently representative, and examined for possible biases that could affect health, safety or fundamental rights.
Data-governance practices must cover the relevant design choices, data collection processes and the origin of the data, preparation operations such as annotation, labelling, cleaning and aggregation, the formulation of assumptions about what the data is meant to measure and represent, an assessment of the availability, quantity and suitability of the datasets, and examination for possible biases — including those likely to lead to discrimination — with appropriate measures to detect, prevent and mitigate them. Datasets must also account for the specific geographical, contextual, behavioural or functional setting in which the system will be used.
- Art. 10
- Art. 10(5)
- Annex IV
Data governance: why it matters
Article 10 is the provision that makes discrimination a product-compliance failure rather than only a litigation risk, and it demands provenance evidence that many teams simply never collected: where the data came from, what assumptions it encodes, who annotated it and how. It also contains a rare permission — Article 10(5) allows processing special categories of personal data strictly where necessary to detect and correct bias, subject to safeguards — which is often the only lawful route to measuring fairness at all.
Data governance in practice
A provider building a credit model for the whole EU discovers its training data is 80% German. That is a representativeness failure for a system marketed Union-wide, because repayment behaviour and credit-file structures differ across member states. The fix touches data collection, the documented assumptions, and the intended-purpose statement — a provider that cannot source representative data may have to narrow the declared geographical scope of the system instead.
Data governance: the mistake people make
Reading "representative" as "large". Volume is not the test; the dataset must be sufficiently representative and appropriately statistically suitable for the intended purpose and the deployment setting. A hundred million records from one country is worse than a well-designed sample across the markets you actually sell to.
Data governance: common questions
- Does Article 10 require perfect, error-free datasets?
- No. It requires datasets to be relevant, sufficiently representative and, to the best extent possible, free of errors and complete in view of the intended purpose. It is a best-efforts standard proportionate to the purpose, not a guarantee.
- Can we process sensitive data to test for bias?
- Article 10(5) permits processing special categories of personal data where strictly necessary to detect and correct bias in high-risk systems, subject to safeguards including technical limits on re-use, pseudonymisation and deletion once the bias has been corrected.
- Does data governance apply to systems using third-party data?
- Yes. The provider is responsible for the governance of the data it uses regardless of source, which means the provenance, licensing and representativeness of purchased or scraped datasets must be documented like any other.
Data governance: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.