How to use this checklist
For background on Article 10, see what Article 10 means for your training data. Article 10 applies to high-risk AI systems. It sets quality requirements for the training, validation and test data they are built on. Go through the points below for each data set, and write down your answer and the evidence. The wording follows the current amended text on the Commission’s AI Act Service Desk. This is general information, not legal advice.
Data governance practices (Article 10(2))
Your data governance and management practices must fit the purpose of the system and cover in particular:
- (a) Design choices: which data you chose and why.
- (b) Collection and origin: how the data was collected, where it comes from, and for personal data, the original purpose of collecting it.
- (c) Preparation: annotation, labelling, cleaning, updating, enrichment and aggregation.
- (d) Assumptions: what the data is supposed to measure and represent.
- (e) Availability, quantity and suitability of the data sets you need.
- (f) Possible biases that could affect health and safety, fundamental rights, or lead to unlawful discrimination, especially where outputs feed back into future inputs.
- (g) Measures to detect, prevent and reduce the biases you found.
- (h) Data gaps or shortcomings that prevent compliance, and how you will address them.
Quality of the data (Article 10(3) and (4))
- The data sets are relevant, sufficiently representative and, as far as possible, free of errors and complete for the intended purpose.
- They have suitable statistical properties, including for the people or groups the system will be used on. This can be met per data set or for a combination of data sets.
- As far as the purpose requires, they reflect the specific geographical, contextual, behavioural or functional setting where the system will be used.
What changed in the amended text
Paragraph 5, on processing special categories of personal data to detect bias, has been deleted. That topic now sits in the new Article 4a: such processing is allowed only exceptionally, when strictly necessary, and under strict conditions on top of the GDPR, for example that synthetic or anonymised data would not be enough, with strong access control, and deletion once the bias is corrected or the retention period ends. Paragraph 6 says that systems which do not train models apply paragraphs 2 to 4 to their test data only.
When it applies
Under the consolidated text shown on the AI Act Service Desk (checked 12 October 2026), the rules for high-risk systems listed in Annex III apply from 2 December 2027, and for systems covered by Annex I from 2 August 2028. The Service Desk FAQ still describes these changes as a proposal, so check the current text before you plan around a date.
Where checks help
Point (c) on cleaning and point (h) on gaps are where file-by-file checks give you evidence: which files were broken, duplicated, blurry or contained personal data, and what you decided. Automated checks do not decide whether your data is representative, and they do not make a system compliant.