Who Article 10 applies to
Article 10 sets data and data-governance requirements for high-risk AI systems, the categories defined by the AI Act. The obligations rest mainly on the provider, the organisation that develops the system or has it developed and places it on the market or puts it into service under its own name or trademark. If your system is not high-risk, Article 10 does not apply directly, but the same practices still make models more reliable. Check the current application dates on the European Commission’s AI Act Service Desk.
What it requires
Training, validation and testing data sets must be subject to data governance and management practices appropriate for the intended purpose. Article 10(2) lists what those practices concern, including design choices, data collection and origin, preparation steps such as annotation, labelling and cleaning, assumptions about what the data represents, an assessment of availability, quantity and suitability, examination of possible biases and measures against them, and the identification of data gaps.
Article 10(3) adds that the data sets shall be “relevant, sufficiently representative, and to the best extent possible, free of errors and complete in view of the intended purpose.”
The amended text shown on the AI Act Service Desk (checked 12 October 2026) no longer contains paragraph 5 on processing special categories of personal data for bias detection; the article now refers to Article 4a(1). Read the current text there before you rely on any summary, including this one.
A practical checklist
For a point-by-point version, see the Article 10 training data checklist.
- Purpose: write down what the system is for and what the data must represent.
- Origin: record where each data set came from, and for personal data, why it was originally collected.
- Preparation: log every cleaning, labelling and filtering step, with the rules you used.
- Errors: check for broken files, duplicates across splits, blur, frozen video and other defects, and record what you found and decided.
- Representativeness and bias: compare the data with the people and settings the system will be used for, and note gaps.
- Personal data: find it, decide on a legal basis, and minimise it.
- Evidence: keep the record with the model version, so you can show later what the system was trained on.
What tools can and cannot do
Automated checks help with the error, duplicate and personal-data parts of the list and produce a record of what was checked. They do not decide whether data is representative for your purpose, and they do not make a system compliant. This guide is general information, not legal advice.