Data and Data Governance Duties For High-Risk AI

Drew & AI Comply HQ™ Team · June 22, 2026

AI is only as good as the data it is built and tested on. If that data is wrong, thin, or skewed, the system can treat people unfairly. So the EU AI Act sets rules for how you collect, check, and manage it (called data governance, Article 10).

The company that builds the system must follow them. The Act calls that company the provider. These requirements apply from December 2, 2027 for listed uses, like hiring and credit scoring (Annex III). For AI built into products like medical devices (Annex I, Section A), they apply from August 2, 2028.

Which AI systems does Article 10 cover?

Only high-risk AI systems. There are two ways in (Article 6):

A listed use (Annex III). Examples are hiring, credit scoring, school admissions, and access to public benefits. Biometrics, critical infrastructure, law enforcement, migration, and justice are on the list too.
A regulated product (Annex I). The AI is a product, or a safety part of a product, that already needs an outside safety check. Medical devices, toys, and lifts are examples.

Not sure where your system sits? Our guide Is your AI system high-risk? walks through the test.

Which data does it cover?

Three kinds of data sets (Article 3(29) to (32)):

Training data is what the model learns from.
Validation data checks the trained model and helps tune it.
Testing data gives an independent check before the system is sold or used.

If your system does not learn from data at all, the rules apply only to your testing data (Article 10(6)).

What must good data look like?

Your data sets must fit the system's intended purpose. Article 10(3) asks for data that is:

relevant to the task
representative enough of the people and situations the system will meet
as free of errors and as complete as you can make it
statistically right for the people or groups the system will be used on

The data must also reflect the setting where the system will run (Article 10(4)). That means the place, the context, and how people behave there, as far as the purpose calls for it. A hiring tool for applicants in Spain, for example, needs data that reflects applicants in Spain.

What must your data practices cover?

Article 10(2) lists what your data governance must cover:

Your design choices
How you collected the data, where it came from, and, for personal data, why it was first collected
How you prepared it, like labeling, cleaning, updating, enriching, and combining
What you assume the data measures and represents
Whether you have enough of the right data
A check for biases that could harm health or safety, hurt fundamental rights, or lead to unlawful discrimination
Steps to find, prevent, and reduce those biases
Gaps or flaws in the data that stop you from complying, and how you will fix them

How should you handle bias?

The Act does not ask for perfect, bias-free data. It asks you to look for bias and reduce it (Article 10(2)(f) and (g)).

Pay extra attention when the system's outputs feed back into its future inputs. Systems that keep learning after launch must be built to limit this loop (called a feedback loop, Article 15(4)).

Sometimes you need sensitive personal data to find bias, like ethnic origin or health data. The Act lets providers use it only when strictly necessary, and only with these safeguards (Article 4a(1)):

Other data, including synthetic or anonymized data, would not do the job.
The data is protected, pseudonymized, and never passed to other parties.
Access is tightly controlled and recorded.
You delete the data once the bias is fixed, or when its retention period ends, whichever comes first.
Your GDPR records explain why you needed it.

What should you write down?

Your technical documentation must describe your data (Annex IV, point 2(d)). Include:

where each data set came from, its scope, and its main features
how you got and chose the data
how you labeled and cleaned it
the validation and testing data you used, and your test results (Annex IV, point 2(g))

Your written processes for building the AI must also cover how you handle data (Article 17(1)(f)). The Act calls those processes a quality management system. Keep this documentation for 10 years after the system goes on the market (Article 18).

Each EU country has authorities that check AI on its market (called market surveillance authorities). They can ask to see your actual data sets, not only your paperwork (Article 74(12)).

Who is responsible for the data?

The provider. That stays true when data, tools, or models come from someone else.

Suppliers. Some systems use a model, tool, component, or service from another company. Agree in writing on the information and help you need from them to comply (Article 25(4)). Free and open-source tools are exempt, except general-purpose AI models.
General-purpose AI models. Some systems are built on a large model, like the ones behind chatbots. That model's provider must give you documentation about it (Article 53(1)(b)). Models released as free and open source, with their weights and other key details made public, are exempt from this duty. Models with systemic risk get no exemption (Article 53(2)). Article 51 sets which models carry systemic risk.
Businesses that use the system. A deployer that controls the input data must keep it relevant and representative enough for the purpose (Article 26(4)).

When does Article 10 apply?

December 2, 2027 for Annex III systems
August 2, 2028 for Annex I, Section A systems. Machinery, vehicles, and other Section B products get their AI rules through their own EU laws (Article 2(2)).

Both dates come from the Digital Omnibus on AI (Regulation (EU) 2026/1744). It moved them in July 2026 (Article 113).

Systems already on the market before your date follow a different rule. They only have to comply if their design changes significantly after that date. AI used by public authorities must comply by August 2, 2030 either way (Article 111(2)).

Frequently asked questions

Do we have to keep all our training data?

The Act sets no fixed period for keeping raw data. Authorities can ask to see your training, validation, and testing data sets (Article 74(12)). Your documentation about the data stays on file for 10 years (Article 18). For personal data, the GDPR says to keep it no longer than you need it (Article 5(1)(e) GDPR).

Does synthetic data count?

Yes. All training, validation, and testing data must meet the same quality rules, wherever it comes from (Article 10(3)). Record how you generated it (Annex IV, point 2(d)).

What if we find bias after launch?

Your monitoring after launch should catch it (Article 72). If the system no longer meets the rules, take corrective action. That can mean fixing, withdrawing, disabling, or recalling it. Tell your distributors and the businesses using it (Article 20(1)).

Does the GDPR still apply?

Yes. The AI Act leaves the GDPR in place (Article 2(7)). The bias rule in Article 4a comes on top of the GDPR, not instead of it.

Is there an exemption for small companies?

No. Small and medium-sized companies (SMEs) can simplify parts of their quality paperwork (Article 63(1)). Article 10 still applies in full (Article 63(2)).

SMEs can also use a simplified technical documentation form (Article 11(1)). Since July 2026, companies just above SME size can use it too. The Act calls them small mid-caps, or SMCs.

What happens if we get it wrong?

Breaking a provider duty can cost up to 15 million EUR or 3% of worldwide annual turnover (Article 99(4)). The higher of the two is the cap. For SMEs and SMCs, the cap is whichever is lower (Article 99(6) and (6a)). Authorities can also require fixes, or take the system off the market (Article 79). Our guide to EU AI Act fines and penalties has the full picture.

Update: the Digital Omnibus is now law (October 7, 2026)

In July 2026 the EU changed some AI Act dates. The change is called the Digital Omnibus on AI (Regulation (EU) 2026/1744). It has been law since July 27, 2026. The dates in this article follow it.

What changed for data governance:

High-risk rules start later (Article 113). AI used for hiring, credit scoring, education, and the other listed uses (Annex III) must comply from December 2, 2027. AI built into products like medical devices and toys (Annex I, Section A) follows on August 2, 2028. Machinery, vehicles, drones, and other Section B products get their AI rules through their own EU laws (Article 2(2)).
The sensitive data rule moved (Article 4a). It used to sit in Article 10(5). The new Article 4a keeps the same safeguards. It also lets makers and users of other AI systems use such data to find bias (Article 4a(2)).
Small mid-caps get SME help (Articles 11 and 99). They can use the simplified technical documentation form. They also get the lower fine cap, except for the banned practices.

What did not change: the data quality rules in Article 10(2) to (4) are the same as before.

To see which dates apply to you, run the free risk check.

Sources

This page is informational content, not legal advice. Talk to a qualified lawyer about your specific situation.