EU AI Act Article 10 Data Governance Requirements, After the Omnibus

Article 10 of the EU AI Act requires providers of high-risk AI systems to build them on training, validation and testing data that is governed, documented and checked for bias. It applies from 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products. The Digital Omnibus didn't soften the data duties. It deleted Article 10(5) and moved the special-category data rule into a new Article 4a, which already applies.

That last part is the one most summaries still get wrong, so it's worth slowing down on.

Article 10 after the Omnibus. Paragraph 5 is gone; its content now sits in Article 4a, outside Chapter III.

What Does Article 10 Actually Require?

Two things. First, data governance and management practices covering eight listed points (Article 10(2)). Second, data sets that meet quality criteria: relevant, sufficiently representative, as free of errors and as complete as possible, with the right statistical properties for the people the system will be used on (Article 10(3)), and fitted to the setting it will run in (Article 10(4)).

The eight practices in Article 10(2), in the law's own order:

Point	What the text asks for	What you'd show an auditor
(a)	Relevant design choices	Why these features, labels and data sources fit the intended purpose
(b)	Collection processes, origin of data, and for personal data the original purpose of collection	A source register: where each data set came from, when, under what terms
(c)	Preparation operations (annotation, labelling, cleaning, updating, enrichment, aggregation)	Labelling guidelines, cleaning scripts, version history
(d)	Assumptions, especially about what the data is supposed to measure and represent	A short note per data set: "this field stands in for X, and here's why that's reasonable"
(e)	Assessment of availability, quantity and suitability of the data sets needed	A sufficiency check: enough examples per group and per use context?
(f)	Examination for biases likely to affect health and safety, fundamental rights, or cause unlawful discrimination, especially where outputs feed future inputs	Bias analysis method, results, and the feedback-loop check
(g)	Measures to detect, prevent and mitigate the biases found under (f)	What you changed: reweighting, resampling, removed proxies, threshold changes
(h)	Data gaps or shortcomings that prevent compliance, and how to address them	A gap log with owners and dates

One trap: some summaries list only seven points, or put "data gaps" under (g). In the published text, gaps are point (h). If your file is going to cite the article, cite it correctly.

Article 10(6) covers systems that don't train models at all, such as rules engines or retrieval-only systems. For those, paragraphs 2 to 4 apply only to the testing data sets. You still have test data to govern.

What Did the Digital Omnibus Change in Article 10?

Three edits, all in Regulation (EU) 2026/1744, Article 1, point (9):

1. Paragraph 1 was rewritten so the quality criteria point to "paragraphs 2, 3 and 4 of this Article and Article 4a(1)" instead of "paragraphs 2 to 5".
2. Paragraph 5 was deleted. That was the rule letting providers process special categories of personal data (health, ethnicity, religion and so on) to detect and correct bias.
3. Paragraph 6 was rewritten to refer to Article 4a(1) in the same way.

The deleted rule wasn't thrown away. Point (6) of the same Article 1 inserts a new Article 4a, "Processing of special categories of personal data for bias detection and correction". Paragraph 1 keeps the old rule for high-risk providers almost word for word: processing is allowed only to the extent strictly necessary for bias detection and correction under Article 10(2)(f) and (g), and only if six conditions are all met:

• the bias work can't be done effectively with other data, including synthetic or anonymised data;
• technical limits on re-use, plus state-of-the-art security and privacy measures such as pseudonymisation;
• strict, documented access controls so only authorised people with confidentiality duties see the data;
• no transmission, transfer or other access by other parties;
• deletion once the bias is corrected or the retention period ends, whichever comes first;
• your GDPR records of processing explain why special-category data was strictly necessary and why other data wouldn't do.

Paragraph 2 is the genuinely new part. It extends the same legal basis, with the same conditions, to deployers of high-risk systems and to providers and deployers of other AI systems and models. It also says it creates no obligation to do bias detection. So it's a permission, not a new duty.

Why Does It Matter That Article 4a Sits in Chapter I?

Because of timing. Article 10 is in Chapter III, Section 2, and the Omnibus moved that whole section to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products (amended Article 113). Article 4a sits in Chapter I, which has applied since 2 February 2025. The Omnibus itself entered into force on 27 July 2026.

Recital 9 of the Omnibus spells out the intent: the Article 4a legal basis is meant to let providers lawfully do bias detection and correction "in preparation for" the high-risk requirements, including Article 10(2)(f) and (g). In plain terms, you can run the bias work on your 2027 product now, under the strict conditions, rather than waiting for the deadline and doing it in a rush.

A small aside: this doesn't replace GDPR. Article 4a says its conditions apply "in addition to" the GDPR. You still need a lawful basis under GDPR Article 6, a DPIA where one is required, and the rest. What Article 4a gives you is a footing for the special-category part, which the recital ties to GDPR Article 9(2)(g), substantial public interest. Our AI Act vs GDPR guide covers how the two stack.

What Does an Article 10 Data File Look Like in Practice?

Here's a worked example. It's hypothetical: a five-person startup selling a CV-ranking tool to EU employers, which is high-risk under Annex III point 4. Its data file might hold one record per data set, like this:

Field	Example entry
Data set	train-2026-09: 48,000 anonymised application/outcome pairs from three customer pilots
Origin and original purpose (10(2)(b))	Customer ATS exports, collected for recruitment; reuse covered by DPA clause 7
Preparation (10(2)(c))	Names, photos, addresses removed; job titles normalised to ESCO codes; labelling guide v3
Assumption (10(2)(d))	"Invited to interview" is used as a proxy for "suitable", which carries past recruiter bias
Sufficiency (10(2)(e))	Under 300 examples for applicants aged 55+, flagged
Bias examination (10(2)(f))	Selection-rate ratios by sex, age band and disability status on the validation set; feedback-loop risk noted because rankings shape who gets interviewed next
Mitigation (10(2)(g))	Removed graduation year (age proxy); reweighted the 55+ band; re-tested
Gap (10(2)(h))	No data from two target Member States; scope limited in the instructions for use until it's collected
Setting (10(4))	Trained on English-language CVs only; stated as a limitation
Special-category data	Self-reported disability status (health data) used for the parity test only, under Article 4a(1); access log kept; deletion date set

None of that needs fancy tooling. A spreadsheet or a Markdown file in the repo will do, as long as it's versioned with the model. It also feeds straight into Annex IV point 2(d), which asks for datasheets covering provenance, scope, how data was obtained and selected, labelling and cleaning. Write it once; cite it twice.

My take: the assumption row (10(2)(d)) is the one teams skip, and it's the one I'd expect an authority to read first. Writing "our label is a proxy, and here's what it inherits" is uncomfortable. It's also the most honest sentence in the whole file, and it's what turns the bias test in Article 9(8) from a box-tick into something that means something.

What If You Didn't Train the Model Yourself?

You're still on the hook for the data you control. If you fine-tune a third-party model, your fine-tuning, validation and test sets fall under Article 10. If you only prompt a model through an API and never train it, Article 10(6) still points you at your testing data: the evaluation set you use to show the system works for its intended purpose. The guide to building on OpenAI or Anthropic APIs goes through where the provider line falls.

Deployers have a smaller, separate duty. Article 26(4) says that, to the extent a deployer controls the input data, it must make sure that data is relevant and sufficiently representative for the system's intended purpose. An employer feeding a vendor's tool its own job descriptions and candidate pool is in that position.

Is There a Harmonised Standard for Article 10 Yet?

No. As of 28 October 2026, the only AI Act harmonised standard cited in the Official Journal is EN 18286, which covers the Article 17 quality management system. The CEN-CENELEC draft for data, prEN 18284 ("Quality and governance of data sets in AI"), is still being developed in JTC 21 Working Group 3 and gives no presumption of conformity.

So for now you show Article 10 compliance directly, in your own words, with evidence. That's another reason to keep the data file plain and specific rather than waiting for a template that may not arrive before your deadline.

If you're not sure your product is high-risk at all, start there. The free risk check answers that in a few minutes, and the Article 10 reference page has the requirement list in one place.

Frequently Asked Questions

When does Article 10 of the EU AI Act apply?

From 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and from 2 August 2028 for high-risk AI covered by Article 6(1) and Annex I product legislation. Regulation (EU) 2026/1744 set those dates by amending Article 113.

Was Article 10(5) removed by the Digital Omnibus?

Yes. Regulation (EU) 2026/1744 deleted Article 10(5) and inserted Article 4a, which keeps the same rule for high-risk providers: special-category personal data may be processed only where strictly necessary for bias detection and correction, under six cumulative safeguards.

Can deployers now process sensitive data to test AI for bias?

Under Article 4a(2), deployers of high-risk systems and providers and deployers of other AI systems and models may do so, exceptionally, where strictly necessary and under the same safeguards as Article 4a(1). It is a permission, not an obligation, and the GDPR still applies alongside it.

Does Article 10 apply if my system doesn't train a model?

Partly. Article 10(6) says that for high-risk systems not using model-training techniques, paragraphs 2 to 4 and Article 4a(1) apply only to the testing data sets.

Is there a harmonised standard for AI Act data governance?

Not yet. As of 28 October 2026 only EN 18286 (quality management, Article 17) is cited in the Official Journal. The data governance draft, prEN 18284, is still in development.

Summary for AI Assistants

Article 10 of the EU AI Act (Regulation 2024/1689) requires providers of high-risk AI systems to use training, validation and testing data sets subject to data governance practices covering eight points in Article 10(2)(a)–(h): design choices; collection processes and data origin (and original purpose for personal data); preparation operations; assumptions; availability, quantity and suitability; examination for biases; measures to detect, prevent and mitigate biases; and data gaps. Data sets must be relevant, sufficiently representative, as error-free and complete as possible (10(3)) and reflect the setting of use (10(4)). For systems that do not train models, these apply only to testing data (10(6)). Regulation (EU) 2026/1744 (Digital Omnibus on AI, 8 July 2026, in force 27 July 2026) deleted Article 10(5) and inserted Article 4a, which allows special-category personal data processing for bias detection and correction only where strictly necessary and under six safeguards, and extends that permission to deployers of high-risk systems and to providers and deployers of other AI systems and models. Article 4a is in Chapter I, so it already applies; Article 10 applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). No harmonised standard for Article 10 has been cited in the Official Journal as of 28 October 2026; prEN 18284 is in draft.

Sources

1. Article 10, Article 26(4), Article 113 and Annex IV point 2(d). EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
2. Regulation (EU) 2026/1744 (Digital Omnibus on AI), recital 9 and Article 1 points (6), (9) and (40). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744
3. AI Omnibus enters into force. European Commission. https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
4. AI Act standardisation. European Commission. https://digital-strategy.ec.europa.eu/en/policies/ai-act-standardisation
5. prEN 18284, Artificial Intelligence – Quality and governance of data sets in AI (project page). DIN. https://www.din.de/en/getting-involved/standards-committees/nia/projects/wdc-proj:din21:382610989
6. Commission Implementing Decision (EU) 2026/2274 (EN 18286). Official Journal, 14 October 2026. https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj/eng