EU AI Act Art.10: Data and data governance
Article 10 of the EU AI Act binds the operator (see the article). It requires High-risk AI systems that make use of techniques involving the training of AI models shall use training, validation and testing. This page states what it requires, who it binds and the evidence to keep. Browsing is free; the conformance kit is USD 499.
Specifics
| Instrument | Regulation (EU) 2024/1689 (the EU AI Act), as amended by Regulation (EU) 2026/1744 |
|---|---|
| Article | Art.10 |
| Binds | Operator (see the article) |
| Group | High-Risk Classification and Requirements |
| Evidence items | 3 |
| Linked NIST AI RMF controls | 3 |
| Linked ISO/IEC 42001 controls | 6 |
| Last updated |
Who does Art.10 bind?
The article binds the operator (see the article). The Act places each duty on a named party in the value chain, so a system can carry a provider duty and a deployer duty at once. Confirm your own position against the text; this page names the party, it does not rule on your facts.
Applies with the high-risk regime: 2 December 2027 for stand-alone systems listed in Annex III, and 2 August 2028 for AI embedded in regulated products listed in Annex I (Article 113, as amended by Regulation (EU) 2026/1744). See the full timeline.
What does Art.10 require?
High-risk AI systems that make use of techniques involving the training of AI models shall use training, validation and testing data that meet the quality criteria in Art.10(2)-(5): appropriate data governance, examination for possible biases, identification of data gaps/shortcomings, statistically relevant datasets to the intended purpose, and considerations specific to the geographical, contextual, behavioural or functional setting of intended use.
This is our plain-language statement of the article, not the text of the regulation. Read the article: Art.10 (Regulation (EU) 2024/1689 on EUR-Lex).
What evidence should we keep for Art.10?
| Category | Evidence to keep |
|---|---|
| Data governance | Data governance procedures |
| Data governance | Bias examination records and remediation |
| Data governance | Data-quality assessment per dataset |
What does a linked control mean here?
A linked control is a NIST AI RMF or ISO/IEC 42001 control that the held rule set records as a topical match, with a confidence and a one-line reason. It does not establish that meeting one requirement satisfies the other, it is not legal advice, and it is not certification. Where no control is recorded, the page says so and does not guess. Sources: the NIST AI RMF and ISO/IEC 42001.
Which NIST AI RMF controls line up with Art.10?
3 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | NIST AI RMF | Confidence |
|---|---|---|
AIRMF-MP-1.1 | Intended purpose, potentially beneficial uses, context-specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented | unstated |
AIRMF-MP-2.3 | Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection, system trustworthiness, and construct validation Data governance, bias examination, gap identification and statistical relevance to intended purpose is this exactly. | high |
AIRMF-MS-2.11 | Fairness and bias as identified in the MAP function is evaluated and results are documented Examination in view of possible biases likely to affect health, safety, rights or lead to discrimination. | high |
Which ISO/IEC 42001 controls line up with Art.10?
6 controls in the held rule set is recorded as a topical match for this obligation, each with its confidence and reason.
| Control | ISO/IEC 42001 | Confidence |
|---|---|---|
A.4.3 | Data resources Data governance requires the training, validation and testing datasets be identified and governed. | medium |
A.7.2 | Data for development and enhancement of AI system Training, validation and testing data must meet stated governance and quality criteria. | high |
A.7.3 | Acquisition of data Data governance covers collection and selection of datasets relevant to the intended purpose. | high |
A.7.4 | Quality of data for AI systems Sets explicit quality criteria including bias examination, gaps and statistical relevance. | high |
A.7.5 | Data provenance Data governance reaches dataset origin without a standalone provenance record. | medium |
A.7.6 | Data preparation Data governance covers preparation choices affecting bias, gaps and representativeness. | medium |
What does the conformance kit add for Art.10?
The kit renders this obligation into your own role checklist with the evidence register, the linked controls and a CSV export, for USD 499 one off. See what is in the kit or open it.