Article 10 of the AI Act: Training Data Requirements and Practical Application

Scope and Definition of Article 10

Article 10 of Regulation (EU) 2024/1689, commonly known as the AI Act, establishes specific requirements for the training, validation, and testing datasets used in the development of high-risk AI systems. Its objective is to ensure that these systems are based on high-quality data that minimizes risks to health, safety, and fundamental rights.

This article applies to high-risk AI systems that utilize model training techniques. If the system does not employ such techniques, the requirements are limited exclusively to testing datasets. The regulation mandates that data must meet criteria of relevance, representativeness, accuracy, and completeness, tailored to the intended purpose of the system.

The distinction between systems that employ model training techniques and those that do not is critical for determining the scope of data obligations. For systems that do not utilize such techniques, the regulatory burden is significantly reduced, focusing exclusively on the quality of testing datasets. This bifurcation ensures that the regulatory framework remains proportionate to the complexity of the AI system, avoiding unnecessary compliance costs for simpler architectures while maintaining rigorous standards for those capable of learning and adapting from data.

The requirement for data to be tailored to the intended purpose implies a dynamic assessment rather than a static one. As the intended purpose of a high-risk AI system may evolve or be refined during its lifecycle, the relevance, representativeness, accuracy, and completeness of the datasets must be continuously re-evaluated. This ensures that the data remains fit for purpose throughout the system's operational life, preventing drift in data quality that could compromise the system's safety and fundamental rights compliance.

The Four Data Quality Criteria

The law defines four fundamental pillars for data quality. First, relevance: the data must be suitable for the specific purpose of the system. Second, representativeness: the datasets must adequately reflect the persons or groups on which the system will be used, including their statistical properties.

Third, accuracy: the data must be free of errors to the extent possible. Fourth, completeness: the data must be complete for the pursued purpose. These criteria can be met at the level of individual datasets or through the combination of multiple datasets. Data governance must include processes for collection, preparation, annotation, and bias assessment.

The criterion of representativeness is particularly complex because it requires not only statistical mirroring of the target population but also an understanding of the underlying distributions that may influence system performance. This includes considering demographic, geographic, and behavioral variables that could affect how the AI system interacts with different groups. Failure to adequately capture these nuances can lead to disparate impacts, where the system performs well for the majority but poorly for specific subgroups, thereby violating the principle of non-discrimination.

Accuracy, defined as freedom from errors to the extent possible, acknowledges the inherent limitations of data collection and processing. However, it places a high burden on providers to implement robust data cleaning and validation procedures. This involves not only correcting obvious errors but also identifying and addressing systematic biases in labeling or data acquisition. The 'extent possible' qualifier requires providers to document the efforts made to minimize errors and the residual risks that remain, demonstrating a diligent approach to data quality management.

Governance and Bias Management

Article 10, paragraph 2, requires data governance practices that address everything from design options to the identification of gaps. It is mandatory to examine potential biases that may affect health, safety, or fundamental rights, especially when data outcomes influence inputs for future operations.

Providers must implement measures to detect, prevent, and mitigate these biases. Documentation must include hypotheses about what the data represents and an assessment of the availability and suitability of the datasets. This governance is not optional but a binding legal requirement for system conformity.

The governance process outlined in Article 10, paragraph 2, is not merely a procedural checklist but a continuous cycle of assessment and improvement. The formulation of hypotheses about what the data represents is a crucial step that requires deep domain expertise. Providers must articulate clear assumptions about the data's provenance, collection methods, and potential limitations. These hypotheses serve as the foundation for subsequent bias assessments and mitigation strategies, ensuring that the data governance process is grounded in a realistic understanding of the data's characteristics.

The requirement to examine potential biases that may affect health, safety, or fundamental rights, especially when data outcomes influence future operations, highlights the recursive nature of AI systems. In such cases, biases in the data can be amplified over time as the system's outputs are fed back into the training process. This feedback loop necessitates proactive monitoring and intervention to prevent the entrenchment of discriminatory patterns. Providers must therefore implement mechanisms to detect and correct biases not only in the initial dataset but also in the ongoing data streams that update the system.

Exceptions for Sensitive Data

Paragraph 5 allows the exceptional processing of special categories of personal data (sensitive data) only if it is strictly necessary to detect and correct biases. This exception is subject to strict conditions to protect fundamental rights and freedoms.

Conditions include the impossibility of achieving the objective through synthetic or anonymized data, the application of state-of-the-art security measures (such as pseudonymization), and the prohibition of transmitting this data to other parties. The data must be deleted once the bias is corrected or the retention period ends, whichever occurs first.

The exception for processing special categories of personal data is narrowly tailored to address the specific challenge of bias detection and correction. The requirement that this processing be strictly necessary implies that providers must exhaust all other means, such as using synthetic or anonymized data, before resorting to sensitive data. This high threshold ensures that the fundamental rights to privacy and data protection are not undermined in the pursuit of bias mitigation. Providers must document the justification for using sensitive data, including the specific biases that cannot be addressed through less intrusive means.

The application of state-of-the-art security measures, such as pseudonymization, is essential to protect the individuals whose data is being processed. Pseudonymization reduces the risk of re-identification, thereby enhancing the security of the data. Additionally, the prohibition on transmitting this data to other parties ensures that the sensitive information remains within the provider's controlled environment, minimizing the risk of unauthorized access or misuse. The mandatory deletion of data once the bias is corrected or the retention period ends further reinforces the principle of data minimization, ensuring that sensitive data is not retained longer than necessary.

Documentation and Linkage with Article 9

Documentation of data curation is a key requirement. Information on collection processes, exclusion decisions, and quality assessments must be recorded. This documentation is not an end in itself but a tool to demonstrate conformity to regulatory authorities.

Data documentation must be linked with the risk management system of Article 9. Biases identified in the data are risks that must be managed within the system's lifecycle. Traceability allows auditing how risks associated with data quality have been mitigated.

The linkage between data documentation and the risk management system of Article 9 is fundamental to the overall compliance strategy. By integrating data governance records into the risk management framework, providers can ensure that data-related risks are identified, assessed, and mitigated in a systematic manner. This integration allows for a holistic view of the system's risks, where data quality issues are not treated in isolation but are considered in the context of the system's overall safety and fundamental rights impact.

Traceability is a key aspect of this linkage, enabling auditors and regulatory authorities to verify how risks associated with data quality have been addressed. This includes tracking the evolution of the datasets, the changes made to address identified biases, and the effectiveness of the mitigation measures implemented. Such traceability not only supports compliance with Article 10 but also enhances the transparency and accountability of the AI system, fostering trust among users and stakeholders.

Compliance Checklist and Sanctions

To demonstrate compliance, providers must maintain an operational checklist that verifies each criterion of Article 10. This includes validating representativeness, documenting bias mitigation measures, and justifying the use of sensitive data if applicable.

Non-compliance with the AI Act requirements can result in significant sanctions. Although Article 10 does not specify direct fines, its non-compliance affects the general conformity of the high-risk system, which may lead to sanctions under Article 99, establishing fines of up to 35 million euros or 7% of the global annual turnover for the most serious infringements.

The compliance checklist serves as a practical tool for providers to demonstrate their adherence to the requirements of Article 10. By systematically verifying each criterion, providers can identify gaps in their data governance processes and take corrective actions before they result in non-compliance. This proactive approach not only reduces the risk of sanctions but also improves the overall quality and reliability of the AI system. The checklist should be regularly updated to reflect changes in the system, the data, or the regulatory environment.

The potential sanctions for non-compliance, while not specified directly in Article 10, are significant and can have severe financial and reputational consequences for providers. The fines under Article 99, which can reach up to 35 million euros or 7% of the global annual turnover, underscore the importance of strict adherence to the AI Act's requirements. Providers must therefore invest in robust data governance practices and ensure that their systems are fully compliant with Article 10 to avoid these substantial penalties and maintain their market position.

Keep exploring

Corrections and transparency

If you spot incorrect or outdated information, send us a correction with the page and source we should review.