Data and data governance
Article 10 requires providers of high-risk AI systems to implement a rigorous data governance process for the training, validation, and testing of their models. The goal is to ensure that datasets are relevant, representative, and as free of errors and biases as possible to prevent discriminatory outcomes or system failures.
What it means
In practice, this requirement moves beyond simple data collection; it mandates a systematic "quality assurance" pipeline for data. You must prove that the data used to build the AI is fit for its specific intended purpose and that you have actively sought out and mitigated potential biases.
The scope covers the entire lifecycle of the data: from how it was sourced (provenance), how it was cleaned and labeled, to how it was analyzed for gaps or imbalances. This applies specifically to high-risk AI systems and focuses on technical quality rather than just legal privacy compliance.
How to meet it
- Establish a formal Data Governance Framework that documents the end-to-end process of data selection, preprocessing, and labeling.
- Conduct a representativeness analysis to ensure the training and testing sets reflect the real-world population or environment where the AI will be deployed.
- Implement a bias detection protocol to identify statistical imbalances or historical prejudices within the datasets.
- Document all "data cleaning" activities, including how missing values were handled and why certain data points were excluded.
- Create a gap analysis report identifying any deficiencies in the available data and documenting the steps taken to fill those gaps (e.g., synthetic data or targeted collection).
- Define clear criteria for what constitutes "high quality" data for your specific use case, including metrics for accuracy and completeness.
Evidence an auditor asks for
- Data Provenance Records: Documentation showing where the data originated, its legality of use, and how it was transferred.
- Bias Assessment Reports: Technical logs or reports demonstrating that you tested for bias and documenting any mitigation actions taken.
- Dataset Specifications: Detailed descriptions of the training, validation, and testing sets, including their size, composition, and characteristics.
- Data Labeling Guidelines: The instructions provided to human annotators to ensure consistency and minimize subjective error.
- Validation Reports: Evidence that the system was tested against a dataset separate from the training set to verify performance and fairness.
Common pitfalls
- Confusing GDPR with Article 10: Thinking that because data is "private" or "anonymized," it is therefore "governed." Privacy compliance does not equal quality or bias mitigation.
- Over-reliance on public datasets: Using open-source datasets without performing a gap analysis to ensure they are representative of the specific EU market or target demographic.
- Lack of versioning: Failing to track which version of a dataset was used for which model iteration, making it impossible to audit the "data lineage."