EU AI Act Art. 10: data and data governance

Data and data governance; representative, relevant, error-checked datasets

By Jorge García Aibar Reviewed 2026-09-24

From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-EUAIA-ART10. Drawn from chapter 08.

Text alternative

Clause: EU AI Act, Art. 10.
Duty holder: Provider.
Applies from: 2027-12-02, Deferred.
Artefact: Data cards.
Layers: Layer 02, Layer 03.
Evidence record: Dataset card, +1 more.
Record schemas: Dataset card , Dataset admission record .
The same topic in 18 other frameworks; the crosswalk section below links each clause.

When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.

Data table: the dates

Dates of AIGE-OBL-EUAIA-ART10
Date	Step	Detail
2027-12-02	Deferred	Annex III
2028-08-02	High-risk (Annex I)	Applies to Annex I embedded (product safety-component) systems
2030-08-02	Later step	Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))

Id

AIGE-OBL-EUAIA-ART10

Instrument

EU AI Act (post-Omnibus) law

Compared side by side

ISO 42001 vs EU AI Act · NIST AI RMF vs EU AI Act

Clause

Art. 10

Duty holder

Provider

Authority

National MSA

Applies from

2027-12-02 Deferred · Annex III

Later dates

2028-08-02 Applies to Annex I embedded (product safety-component) systems
2030-08-02 Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))

System class

High-risk (Annex III) · High-risk (Annex I)

The artefact that evidences it

Data cards; lineage; bias and quality tests in CI.

What this obligation connects to Solid edges are direct relations, dashed ones looser (a case that cites the same article, a framework whose clauses only touch the topic); patterns and controls take the colour of their stack layer. Select a node to open it; the lists below give every relation in full.

Data table: every relation

Relations of AIGE-OBL-EUAIA-ART10
Family	Item	Relation
Patterns	Dataset Admission Gate	Direct
Patterns	Fairness Eval Suite	Direct
Patterns	Training-Data Rights Ledger	Direct
Open controls	AIGE-CTL-DATA-001 Dataset Admission Gate at Read Time	Direct
Open controls	AIGE-CTL-DATA-002 Dataset Card for Every Admitted Version	Direct
Open controls	AIGE-CTL-DATA-008 Fitness-for-Purpose Checks Before Admission	Direct
Open controls	AIGE-CTL-DATA-010 Lineage from Training Runs to Admitted Sources	Direct
Open controls	AIGE-CTL-DATA-009 Signed Snapshot Integrity	Direct
Open controls	AIGE-CTL-DATA-003 Training-Data Rights Ledger Row per Source	Direct
Cases	A health-risk score that predicted cost, not need	Cites the article
Cases	A recruiting model that learned the past (reported)	Cites the article
Same crosswalk topic	AI Verify 8.1.1, 8.2.1, 7.1.1, 7.2.1, 7.8.1	Core clause
Same crosswalk topic	CSA AICM DSP-20, DSP-21, GRC-11	Core clause
Same crosswalk topic	China Deep Synthesis DeepSyn Art. 14	Core clause
Same crosswalk topic	China GenAI Measures GenAI Art. 7, GenAI Art. 8, GenAI Art. 11, GenAI Art. 4(2)	Core clause
Same crosswalk topic	CoE Convention CoE Art. 10	Core clause
Same crosswalk topic	EU AI Act Art. 4a, Art. 53, Art. 53(1)(c), Art. 5(1)(e)	Core clause
Same crosswalk topic	GAO AI Accountability 2.1, 2.2, 2.4, 2.5, 2.7, 3.8	Core clause
Same crosswalk topic	GB/T 45654 GB/T 45654 Corpus security	Core clause
Same crosswalk topic	GDPR Art. 5(1)(c), Art. 25, Art. 9, Art. 5(1)(a)	Core clause
Same crosswalk topic	ISO 42001 A.7, A.7.3, A.4, A.5.4	Core clause
Same crosswalk topic	NIST AI RMF MAP 2, MEASURE 2.10, MEASURE 2.11, GOVERN 3.1	Core clause
Same crosswalk topic	Singapore GenAI GenAI 2	Core clause
Same crosswalk topic	TC260 Framework 3.0 TC260 2.1.3, TC260 5.1	Core clause
Same crosswalk topic	UK ATRS ATRS 2.4.3, ATRS 2.4.2	Core clause
Same crosswalk topic	China Algo. Rec. AlgoRec Art. 21	Related clause
Same crosswalk topic	GPAI Code Copyright 1.1–1.5	Related clause
Same crosswalk topic	OECD AI Principles OECD 1.2	Related clause
Same crosswalk topic	OWASP LLM LLM05:2026	Related clause

Patterns that build it

The same topic in other frameworks

From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.

Data governance

ISO 42001 A.7 Data for AI systems (core)
TC260 Framework 3.0 TC260 2.1.3 Data safety risks (core)
China GenAI Measures GenAI Art. 7 Training-data lawful sourcing (core)
China GenAI Measures GenAI Art. 8 Data-annotation standards (core)
China GenAI Measures GenAI Art. 11 Protection of user input and records (core)
China Deep Synthesis DeepSyn Art. 14 Training-data management (core)
GB/T 45654 GB/T 45654 Corpus security Training-corpus (data) security requirements (core) (clause not verified)
GDPR Art. 5(1)(c) Data minimisation (core)
GDPR Art. 25 Data protection by design and by default (core)
ISO 42001 A.7.3 Acquisition of data (core) (clause not verified)
CSA AICM DSP-20 Data Provenance and Transparency (core)
UK ATRS ATRS 2.4.3 Development data specification (core)
Singapore GenAI GenAI 2 Data (core)
GAO AI Accountability 2.1 Sources: document sources and origins of data used to develop the models (core)
GAO AI Accountability 2.2 Reliability: assess reliability of data used to develop the models (core)
AI Verify 8.1.1 Data Governance: put in place measures to ensure data quality over time (core)
AI Verify 8.2.1 Data Governance: understand the lineage of data (origin, collection, curation, movement) through a data provenance record (core)
EU AI Act Art. 4a Special-category data for bias detection
ISO 42001 A.4 Resources for AI systems
NIST AI RMF MAP 2 MAP 2: Categorization of the AI system is performed
NIST AI RMF MEASURE 2.10 MEASURE 2.10: Privacy risk of the AI system is examined and documented
NIST AI RMF MEASURE 2.11 MEASURE 2.11: Fairness and bias are evaluated and results are documented
TC260 Framework 3.0 TC260 5.1 Model R&D safety guidelines
EU AI Act Art. 53 Obligations for providers of general-purpose AI models
EU AI Act Art. 53(1)(c) Copyright policy, including rights reservations
EU AI Act Art. 5(1)(e) Prohibited: untargeted scraping of facial images
GPAI Code Copyright 1.1–1.5 Commitment 1: Copyright policy (Measures 1.1 to 1.5)
GDPR Art. 9 Processing of special categories of personal data
CSA AICM DSP-21 Data Poisoning Prevention & Detection
OWASP LLM LLM05:2026 Data and Model Poisoning
GAO AI Accountability 2.4 Variable selection: assess data variables used in the AI component models
GAO AI Accountability 2.5 Enhancement: assess the use of synthetic, imputed, and/or augmented data

Fairness and non-discrimination

EU AI Act Art. 4a Special-category data for bias detection (core)
GDPR Art. 5(1)(a) Lawfulness, fairness and transparency (core)
NIST AI RMF MEASURE 2.11 MEASURE 2.11: Fairness and bias as identified in the MAP function are evaluated and results are documented (core)
CSA AICM GRC-11 Bias and Fairness Assessment (core)
CoE Convention CoE Art. 10 Equality and non-discrimination (core)
China GenAI Measures GenAI Art. 4(2) Prevent discrimination in design, data, training and service (core)
GAO AI Accountability 2.7 Bias: assess reliability, quality, and representativeness of the data used in operation, including potential biases (core)
GAO AI Accountability 3.8 Bias: identify potential biases, inequities, and other societal concerns resulting from the AI system (core)
AI Verify 7.1.1 Fairness (technical test): measure algorithmic fairness of predictions against ground truth, with metrics chosen for the sensitive feature (core)
AI Verify 7.2.1 Fairness (technical test): benchmark and red-team for harms against individuals or groups (generative AI) (core)
GDPR Art. 9 Processing of special categories of personal data
ISO 42001 A.5.4 Assessing AI system impact on individuals or groups of individuals (clause not verified)
NIST AI RMF GOVERN 3.1 GOVERN 3.1: Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team
UK ATRS ATRS 2.4.2 Model specification
OECD AI Principles OECD 1.2 Rule of law, human rights and democratic values, including fairness and privacy
China Algo. Rec. AlgoRec Art. 21 No unreasonable differential treatment in trading conditions
AI Verify 7.8.1 Fairness: check that training data is representative of the end-user population, resampling or collecting more data where needed

Cases that cite this article

Open controls that evidence it

Draft controls in the open control profiles that map to this row: each states a requirement and the evidence it must leave behind.

AIGE-CTL-DATA-001 Dataset Admission Gate at Read Time (Data admission and privacy profile)
AIGE-CTL-DATA-002 Dataset Card for Every Admitted Version (Data admission and privacy profile)
AIGE-CTL-DATA-003 Training-Data Rights Ledger Row per Source (Data admission and privacy profile)
AIGE-CTL-DATA-008 Fitness-for-Purpose Checks Before Admission (Data admission and privacy profile)
AIGE-CTL-DATA-009 Signed Snapshot Integrity (Data admission and privacy profile)
AIGE-CTL-DATA-010 Lineage from Training Runs to Admitted Sources (Data admission and privacy profile)

Source

Chapter 08, section EU AI Act, post-Omnibus, checked against its sources on the review date above.

Machine-readable

This obligation: /api/v1/obligations/aige-obl-euaia-art10.json
The register: /api/v1/obligations.json · CSV
Schema and stability promise: open data and API

Cite this obligation

García Aibar, J. (2026). EU AI Act Art. 10: data and data governance (AIGE-OBL-EUAIA-ART10). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-euaia-art10. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{EU AI Act Art. 10: data and data governance (AIGE-OBL-EUAIA-ART10)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-euaia-art10},
  note         = {Version 0.5.0}
}