Article 10 — Data and Data Governance

Legal Provision

Data and data governance: requires that data complies with a set of standards during development, updates or retraining.

Scope

Applies to providers of the high-risk AI system.

Requirement type

Duty: before placing a high-risk AI system on the market or put into service, applies also to updated involving retraining or real-world data input.

Actions to demonstrate compliance

A. Binary (yes/no): if these elements are present, there is evidence towards demonstrating compliance.

• Documented data governance and dataset-quality procedures containing the following elements:
• Documented data governance framework.
• Documented dataset specification.
• Documented procedures to detect and correct data errors.
• Bias/ representativeness assessment.
• Error management procedures.

B. Non-binary (require a contextual assessment): building on the binary actions, a contextual assessment of these points is required to further verify compliance with each specific legal basis.

• Statistical analysis of dataset representativeness.
• Bias-detection reports (quantitative fairness metrics).
• Documentation showing how identified biases were corrected.
• Data validation reports.
• Documentation of reviewer checks.

Monitoring requirement

• Verification that data used (training, validation, testing, and real-world inputs) remains appropriate, representative, complete, and free of errors for the intended purpose of the high-risk AI system, and whether data issues lead to new risks or performance degradation.
• Among others:
  • a. Existence of a documented data monitoring policy.
  • b. Documented roles and monitoring responsibilities.
  • c. Documented monitoring schedule.

Consequences of non-compliance

• Administrative fines up to €15 000 000 or 3% of total worldwide annual turnover.
• Penalties and enforcement measures adopted at the Member State level.