EU AI Act Data Governance Policy Template (Article 10)

For high-risk AI systems, Article 10 of the EU AI Act, Regulation (EU) 2024/1689, sets requirements for the training, validation and testing data behind the model. Data governance is consistently the slowest high-risk item to fix, so a documented policy — the one this page templates — is worth starting early. It is a provider duty.

What Article 10 requires

High-risk training, validation and testing datasets must be subject to data-governance practices appropriate to the intended purpose, covering in particular:

• Relevant, sufficiently representative, and as free of errors and complete as possible in view of the intended purpose;
• appropriate design choices and data-collection processes, including the origin of data;
• examination for biases likely to affect health, safety or fundamental rights, or to lead to prohibited discrimination, and measures to detect, prevent and mitigate them;
• identification of data gaps or shortcomings and how they are addressed;
• appropriate statistical properties for the persons or groups on which the system is intended to be used.

Article 10 permits processing of special-category data strictly where necessary for bias detection and correction, with safeguards.

The policy — fields to capture

1. Scope. System(s) covered; intended purpose; Annex III category; data controller/owner.

2. Data sources and provenance. Each dataset, its origin, licence/lawful basis, and collection method.

3. Relevance and representativeness. How the data fits the intended purpose and target population; known coverage limits.

4. Quality. Error-checking, completeness, labelling quality, and de-duplication processes.

5. Bias examination. Protected characteristics assessed; methods used; findings; mitigations; any special-category data processed for bias correction and its safeguards.

6. Gaps and shortcomings. Identified gaps and the plan to address them.

7. GDPR alignment. Lawful basis, data minimisation, DPIA link (GDPR Article 35), retention.

8. Review. Cadence, owner, and trigger for re-validation (new data, drift, intended-purpose change).

Worked example: a high-risk credit-scoring provider

NordCredit builds a high-risk creditworthiness model (Annex III point 5(b)). Its data-governance policy documents the origin and lawful basis of each dataset, shows the training data is representative of the applicant population, records a bias examination across protected characteristics with mitigations, and notes the special-category data processed under Article 10's bias-correction allowance with safeguards. The policy links to the GDPR DPIA and feeds the Annex IV technical documentation.

How Confir helps

Confir ties the data-governance record to the specific high-risk system and its Annex IV technical file, prompts for each Article 10 element, and keeps the bias-examination and gap records current. The engine is deterministic and rule-based, so the policy stays consistent with the rest of the documentation.

Frequently asked questions

What does Article 10 require for data?

That high-risk training, validation and testing data is relevant, sufficiently representative, and as free of errors and complete as possible for the intended purpose; that design and collection are appropriate; that data is examined for biases and gaps with mitigation; and that it has suitable statistical properties for the target population.

Does Article 10 apply to all AI?

No. It is a high-risk requirement under Chapter III. Minimal- and limited-risk systems do not carry the Article 10 data-governance duty, though good data practice is always sensible. Classify the system first.

Can we process special-category data to check for bias?

Yes, in a narrow way. Article 10 permits processing special-category data strictly where necessary to detect and correct bias in high-risk systems, subject to safeguards. This is an exception to be documented carefully, alongside your GDPR obligations.

How does this relate to GDPR?

They run in parallel. Article 10 is about data quality and bias for high-risk AI; GDPR governs the lawfulness of processing personal data. The data-governance policy should link to your GDPR lawful basis and, where relevant, the DPIA under GDPR Article 35.

When does the obligation apply?

With the rest of the high-risk regime: stand-alone Annex III obligations apply from 2 December 2027, the date set by the Digital Omnibus adopted in June 2026; product-embedded Annex I systems follow on 2 August 2028. Because data remediation is slow, start it well before the applicable date.

Related guides

• Conformity assessment checklist
• DPIA and FRIA for AI systems
• Annex III high-risk use cases
• Human oversight protocol template
• How AI risk classification works