Data Governance

Article 10 requires providers of high-risk AI systems to apply data governance and management practices to the training, validation, and testing data used in developing those systems. The quality of data directly affects the safety and fundamental rights implications of an AI system.

Dataset Requirements

Article 10(3) specifies that training, validation, and testing datasets must meet certain quality criteria: they must be relevant to the intended purpose; sufficiently representative of the population or context the system will encounter; and, to the extent possible, free of errors and complete. These requirements do not impose absolute standards -- "to the extent possible" acknowledges practical limitations -- but they do require documented efforts to achieve data quality.

Bias Detection and Special Category Data

Article 10(5) permits providers to process special categories of personal data (under GDPR Article 9) for the purpose of bias monitoring, detection, and correction in high-risk AI systems. This is a significant derogation from normal GDPR processing restrictions, but it is conditioned on appropriate safeguards: access is limited to authorised persons, data is deleted after bias analysis, and specific technical and organisational measures are applied.

• Data governance documentation must be retained as part of technical documentation under Annex IV
• Article 10(4) requires examination of possible biases that could affect health, safety, or fundamental rights
• The bias detection exception for special category data under Article 10(5) has strict conditions
• Training data provenance must be traceable to support post-market monitoring obligations
• Data governance practices must account for foreseeable geographic and contextual deployment variations