Data Governance for AI

Article 10 of the EU AI Act establishes specific requirements for training, validation, and testing data used in high-risk AI systems. Data quality, bias testing, lineage, representation, and annotation — your AI system is only as compliant as its data.

Article 10 Requirements

What the EU AI Act demands from your data

Six data governance requirements for high-risk AI systems — each demanding documented processes, quality metrics, and ongoing oversight.

Training Data Quality

Art. 10(2)

Training, validation, and testing datasets must be subject to appropriate data governance and management practices. This includes examination of possible biases, identification of data gaps, and measures to address quality deficiencies.

Bias Testing

Art. 10(2)(f)

Providers must examine datasets for possible biases that could lead to discrimination. This requires statistical analysis of representation across protected characteristics, intersectional analysis, and documented mitigation measures.

Data Lineage

Art. 10(2)(b)

The origin, collection methodology, and processing history of training data must be documented. Data lineage enables regulators and auditors to trace how data flowed from source to model — and whether consent and licensing were maintained throughout.

Representation

Art. 10(3)

Training datasets must be relevant, sufficiently representative, and free of errors to the extent required by the intended purpose. Under-representation of demographic groups in training data can create discriminatory outcomes in deployed systems.

Annotation Standards

Art. 10(2)(c)

Data labelling and annotation must follow documented processes with quality controls. Annotator instructions, inter-annotator agreement metrics, and dispute resolution procedures all fall under the data governance umbrella.

Statistical Properties

Art. 10(2)(e)

Providers must document the statistical properties of training data — distribution characteristics, feature correlations, and coverage analysis. This documentation enables assessment of whether data is fit for the system's intended purpose.

Lifecycle

The data governance lifecycle

Data governance is not a one-time activity. From collection to retirement, each phase carries distinct compliance obligations.

Collection

Phase 1

Data sourcing with documented provenance. Every dataset needs a data sheet: source, collection method, consent basis, licensing terms, geographical coverage, temporal scope, and known limitations.

Curation

Phase 2

Data cleaning, deduplication, and enrichment with quality gates. Curation decisions must be documented — what was removed, why, and what effect this has on data distribution and representation.

Validation

Phase 3

Systematic validation against quality criteria: completeness, consistency, accuracy, and representativeness. Validation results form part of the technical documentation required for conformity assessment.

Monitoring

Phase 4

Ongoing monitoring of data quality and relevance throughout the system's lifecycle. Data drift detection, distribution shift analysis, and periodic re-validation ensure continued compliance as the world changes.

Retirement

Phase 5

Controlled retirement of datasets with documented rationale. Retention policies must balance regulatory requirements (keeping data for audit) with data protection obligations (minimisation and erasure rights).

Data That Stands Up to Scrutiny

From data lineage to bias testing — structured guidance for building data governance processes that satisfy Article 10 and stand up to regulatory audit.

Request Access Talk to Us