{"id":319,"date":"2026-11-03T18:30:00","date_gmt":"2026-11-03T13:00:00","guid":{"rendered":"https:\/\/www.graveiensai.com\/blog\/?p=319"},"modified":"2026-11-02T07:51:47","modified_gmt":"2026-11-02T02:21:47","slug":"eu-ai-act-training-data-requirements","status":"publish","type":"post","link":"https:\/\/www.graveiensai.com\/blog\/eu-ai-act-training-data-requirements\/","title":{"rendered":"EU AI Act Training Data Requirements: What Article 10 Means for Data Vendors"},"content":{"rendered":"\n<p class=\"last-updated wp-block-paragraph\">Last updat\u00aded: Novem\u00adber 2026<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>EU AI Act train\u00ading data require\u00adments sit main\u00adly in Arti\u00adcle 10. They apply to high-risk AI sys\u00adtems and cov\u00ader train\u00ading, val\u00adi\u00adda\u00adtion and test\u00ading data sets.<\/li>\n\n\n<li>After the Dig\u00adi\u00adtal Omnibus on AI, Arti\u00adcle 10 applies to Annex III high-risk sys\u00adtems from 2 Decem\u00adber 2027 and to Annex I prod\u00aduct-embed\u00added sys\u00adtems from 2 August 2028.<\/li>\n\n\n<li>The provider owns the legal duty. Data ven\u00addors sup\u00adply the evi\u00addence, such as con\u00adsent records, prove\u00adnance, QA reports and bias reviews.<\/li>\n\n\n<li>The old Arti\u00adcle 10(5) rule on spe\u00adcial-cat\u00ade\u00adgo\u00adry data for bias detec\u00adtion now sits in a new Arti\u00adcle 4a, with six strict con\u00addi\u00adtions.<\/li>\n\n\n<li>GDPR still applies in par\u00adal\u00adlel. An AI Act-ready dataset also needs a law\u00adful basis and a clean con\u00adsent trail.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Buy\u00aders and audi\u00adtors now ask high-risk AI teams one hard ques\u00adtion. Can you prove where your data came from, and that it fits the job? EU AI Act train\u00ading data require\u00adments turn that ques\u00adtion into a legal duty.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Arti\u00adcle 10 sets out how train\u00ading, val\u00adi\u00adda\u00adtion and test\u00ading data must be gov\u00aderned, checked for bias and doc\u00adu\u00adment\u00aded. The Dig\u00adi\u00adtal Omnibus on AI moved the dates, but the core duties stayed. This guide explains what Arti\u00adcle 10 says, who owns each task, and the evi\u00addence pack your data ven\u00addor should hand over.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Not legal advice:<\/strong> this arti\u00adcle is gen\u00ader\u00adal infor\u00adma\u00adtion. Con\u00adfirm how the AI Act applies to your sys\u00adtem with qual\u00adi\u00adfied EU coun\u00adsel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Build\u00ading a high-risk sys\u00adtem for the EU mar\u00adket? <a href=\"https:\/\/www.graveiensai.com\/contact-us\">Book a 20-minute scop\u00ading call<\/a> and we will map the data evi\u00addence your project still needs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What are the EU AI Act training data requirements?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">EU AI Act train\u00ading data require\u00adments are the Arti\u00adcle 10 rules for high-risk AI sys\u00adtems. Train\u00ading, val\u00adi\u00adda\u00adtion and test\u00ading data must fol\u00adlow doc\u00adu\u00adment\u00aded gov\u00ader\u00adnance prac\u00adtices and meet qual\u00adi\u00adty cri\u00adte\u00adria. They must also reflect the set\u00adting where the sys\u00adtem will run and be exam\u00adined for bias. The provider must be able to show all of this.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In short: Arti\u00adcle 10 does not ban any data source. It asks you to prove your data choic\u00ades.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Which systems are covered?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Arti\u00adcle 10 applies to high-risk AI sys\u00adtems. These include Annex III uses such as employ\u00adment, edu\u00adca\u00adtion and access to essen\u00adtial ser\u00advices, plus AI built into prod\u00aducts cov\u00adered by Annex I. The Act reach\u00ades providers that place such sys\u00adtems on the EU mar\u00adket, wher\u00adev\u00ader they are based.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For high-risk sys\u00adtems that do not train mod\u00adels, Arti\u00adcle 10(6) applies the rules only to test\u00ading data sets.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When does Article 10 apply after the Digital Omnibus?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Dig\u00adi\u00adtal Omnibus on AI, Reg\u00adu\u00adla\u00adtion (EU) 2026\/1744, was pub\u00adlished in the Offi\u00adcial Jour\u00adnal on 24 July 2026. It entered into force on 27 July 2026. As of Novem\u00adber 2026, the Euro\u00adpean Com\u00admis\u00adsion\u2019s AI Act Ser\u00advice Desk time\u00adline lists these dates:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>2 August 2025:<\/strong> oblig\u00ada\u00adtions for providers of gen\u00ader\u00adal-pur\u00adpose AI (GPAI) mod\u00adels apply.<\/li>\n\n\n<li><strong>2 August 2026:<\/strong> most rules apply, and enforce\u00adment starts for GPAI mod\u00adels, pro\u00adhi\u00adbi\u00adtions, trans\u00adparen\u00adcy rules and AI lit\u00ader\u00ada\u00adcy.<\/li>\n\n\n<li><strong>2 Decem\u00adber 2027:<\/strong> rules for high-risk AI sys\u00adtems in Annex III apply, includ\u00ading Arti\u00adcle 10.<\/li>\n\n\n<li><strong>2 August 2028:<\/strong> rules for high-risk AI embed\u00added in prod\u00aducts cov\u00adered by Annex I apply.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The delay buys time, not an exemp\u00adtion. Data col\u00adlect\u00aded now will often train the sys\u00adtems that must com\u00adply in late 2027, so build the evi\u00addence dur\u00ading col\u00adlec\u00adtion.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What does Article 10 require, paragraph by paragraph?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Arti\u00adcle 10 has four work\u00ading parts. Para\u00adgraph 2 lists the gov\u00ader\u00adnance prac\u00adtices your data must fol\u00adlow. Para\u00adgraph 3 sets qual\u00adi\u00adty cri\u00adte\u00adria. Para\u00adgraph 4 asks data to match the real-world set\u00adting. A new Arti\u00adcle 4a, added by the Dig\u00adi\u00adtal Omnibus, cov\u00aders sen\u00adsi\u00adtive data used for bias detec\u00adtion.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/article-10-data-governance-map.webp\" alt=\"Hub-and-spoke diagram of EU AI Act Article 10 data governance: origin, preparation, assumptions, suitability, bias checks and gaps\" class=\"wp-image-314\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/article-10-data-governance-map.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/article-10-data-governance-map-300x169.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/article-10-data-governance-map-1024x576.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/article-10-data-governance-map-768x432.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/article-10-data-governance-map-1536x864.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">Arti\u00adcle 10(2) gov\u00ader\u00adnance prac\u00adtices, grouped into six evi\u00addence areas: ori\u00adgin, prepa\u00adra\u00adtion, assump\u00adtions, suit\u00adabil\u00adi\u00adty, bias checks and gaps.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Article 10(2): data governance and management practices<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Arti\u00adcle 10(2) says data sets \u201cshall be sub\u00adject to data gov\u00ader\u00adnance and man\u00adage\u00adment prac\u00adtices appro\u00adpri\u00adate for the intend\u00aded pur\u00adpose\u201d of the sys\u00adtem. It then lists what those prac\u00adtices must cov\u00ader. Beyond the rel\u00ade\u00advant design choic\u00ades (point a), they fall into six evi\u00addence areas:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Ori\u00adgin (point b):<\/strong> data col\u00adlec\u00adtion process\u00ades and where the data came from. For per\u00adson\u00adal data, record the orig\u00adi\u00adnal pur\u00adpose of col\u00adlec\u00adtion.<\/li>\n\n\n<li><strong>Prepa\u00adra\u00adtion (point c):<\/strong> anno\u00adta\u00adtion, label\u00ading, clean\u00ading, updat\u00ading, enrich\u00adment and aggre\u00adga\u00adtion steps.<\/li>\n\n\n<li><strong>Assump\u00adtions (point d):<\/strong> what the data is sup\u00adposed to mea\u00adsure and rep\u00adre\u00adsent.<\/li>\n\n\n<li><strong>Suit\u00adabil\u00adi\u00adty (point e):<\/strong> an assess\u00adment of the avail\u00adabil\u00adi\u00adty, quan\u00adti\u00adty and suit\u00adabil\u00adi\u00adty of the data sets need\u00aded.<\/li>\n\n\n<li><strong>Bias checks (points f and g):<\/strong> exam\u00adi\u00adna\u00adtion for bias\u00ades that could affect health, safe\u00adty or fun\u00adda\u00admen\u00adtal rights, and mea\u00adsures to detect, pre\u00advent and mit\u00adi\u00adgate them.<\/li>\n\n\n<li><strong>Gaps (point h):<\/strong> data gaps or short\u00adcom\u00adings that block com\u00adpli\u00adance, and how you will address them.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Article 10(3): the quality criteria<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Arti\u00adcle 10(3) is the line most teams quote. Data sets \u201cshall be rel\u00ade\u00advant, suf\u00adfi\u00adcient\u00adly rep\u00adre\u00adsen\u00adta\u00adtive, and to the best extent pos\u00adsi\u00adble, free of errors and com\u00adplete in view of the intend\u00aded pur\u00adpose.\u201d They must also have appro\u00adpri\u00adate sta\u00adtis\u00adti\u00adcal prop\u00ader\u00adties for the peo\u00adple or groups the sys\u00adtem will be used on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note the words \u201cto the best extent pos\u00adsi\u00adble.\u201d The law does not demand per\u00adfect data. It demands a doc\u00adu\u00adment\u00aded effort, judged against the intend\u00aded pur\u00adpose.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Article 10(4): context of use<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Data sets must take into account the \u201cgeo\u00adgraph\u00adi\u00adcal, con\u00adtex\u00adtu\u00adal, behav\u00adiour\u00adal or func\u00adtion\u00adal set\u00adting\u201d where the sys\u00adtem will be used. For a voice sys\u00adtem, that can mean region\u00adal accents, phone-line audio and real back\u00adground noise.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Former Article 10(5): now Article 4a<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Dig\u00adi\u00adtal Omnibus delet\u00aded Arti\u00adcle 10(5) and moved its con\u00adtent into a new Arti\u00adcle 4a. Providers of high-risk sys\u00adtems may \u201cexcep\u00adtion\u00adal\u00adly\u201d process spe\u00adcial cat\u00ade\u00adgories of per\u00adson\u00adal data to detect and cor\u00adrect bias. This is allowed only where strict\u00adly nec\u00ades\u00adsary and when six con\u00addi\u00adtions are all met. Key ones:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>oth\u00ader data, includ\u00ading syn\u00adthet\u00adic or anonymized data, can\u00adnot do the job;<\/li>\n\n\n<li>pseu\u00addo\u00adnymiza\u00adtion and strict access con\u00adtrols apply;<\/li>\n\n\n<li>the data is not trans\u00admit\u00adted to or accessed by oth\u00ader par\u00adties;<\/li>\n\n\n<li>the data is delet\u00aded once the bias is cor\u00adrect\u00aded or reten\u00adtion ends.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Arti\u00adcle 4a applies in addi\u00adtion to GDPR, not instead of it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Article 10 Evidence Pack: a six-file checklist<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Arti\u00adcle 10 says what to gov\u00adern, not which files to keep. We use a sim\u00adple mod\u00adel with data buy\u00aders: the <strong>Arti\u00adcle 10 Evi\u00addence Pack<\/strong>. It is six files every train\u00ading, val\u00adi\u00adda\u00adtion or test deliv\u00adery should car\u00adry, each mapped to Arti\u00adcle 10.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/training-data-documentation-pack.webp\" alt=\"Training data documentation pack folder with six files: datasheet, consent log, provenance, guidelines, QA report and bias review\" class=\"wp-image-315\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/training-data-documentation-pack.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/training-data-documentation-pack-300x169.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/training-data-documentation-pack-1024x576.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/training-data-documentation-pack-768x432.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/training-data-documentation-pack-1536x864.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">The Arti\u00adcle 10 Evi\u00addence Pack: six files a data deliv\u00adery should car\u00adry for EU AI Act review.<\/figcaption><\/figure>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Datasheet.<\/strong> What the data set con\u00adtains, its intend\u00aded pur\u00adpose, vol\u00adumes, splits and known lim\u00adits. Sup\u00adports design choic\u00ades, assump\u00adtions and suit\u00adabil\u00adi\u00adty (10(2)(a), (d), (e)).<\/li>\n\n\n<li><strong>Con\u00adsent log.<\/strong> Who agreed to what, when, and for which use, with with\u00addraw\u00adal han\u00addling. Sup\u00adports the per\u00adson\u00adal-data pur\u00adpose record in 10(2)(b) and your GDPR basis.<\/li>\n\n\n<li><strong>Prove\u00adnance record.<\/strong> Col\u00adlec\u00adtion method, sources, dates, devices and any third-par\u00adty inputs. Sup\u00adports ori\u00adgin (10(2)(b)).<\/li>\n\n\n<li><strong>Guide\u00adlines.<\/strong> Ver\u00adsioned anno\u00adta\u00adtion and label\u00ading rules, with change logs. Sup\u00adports prepa\u00adra\u00adtion (10(2)\u00a9).<\/li>\n\n\n<li><strong>QA report.<\/strong> Sam\u00adpling method, error rates found, rework and accep\u00adtance results. Sup\u00adports the \u201cfree of errors and com\u00adplete\u201d cri\u00adte\u00adri\u00adon (10(3)).<\/li>\n\n\n<li><strong>Bias review.<\/strong> Cov\u00ader\u00adage tables by rel\u00ade\u00advant groups and set\u00adtings, gaps found and actions tak\u00aden. Sup\u00adports bias checks, gaps and con\u00adtext (10(2)(f)-(h), 10(4)).<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The provider folds these files into its tech\u00adni\u00adcal doc\u00adu\u00admen\u00adta\u00adtion. If a file is miss\u00ading, log it as a known gap under 10(2)(h), with a fix plan.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Want to see how con\u00adsent\u00aded, meta\u00adda\u00adta-tagged data looks before you com\u00admit? <a href=\"https:\/\/www.graveiensai.com\/contact-us\">Book a 20-minute scop\u00ading call<\/a>, or scope a pilot billed only on approved files.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who is responsible for training data: the provider or the data vendor?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The provider of the high-risk sys\u00adtem car\u00adries the Arti\u00adcle 10 duty. Sup\u00adply\u00ading data does not make a ven\u00addor the provider. But Arti\u00adcle 25(4) requires the provider and sup\u00adpli\u00aders of tools, ser\u00advices, com\u00adpo\u00adnents or process\u00ades to agree in writ\u00ading on the infor\u00adma\u00adtion and help the provider needs. In prac\u00adtice, the ven\u00addor sup\u00adplies evi\u00addence.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"800\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/ai-act-provider-vs-data-vendor-duties.webp\" alt=\"Two-lane diagram of AI Act duties: provider runs the risk system and documentation; data vendor hands over consent records, labels and QA evidence\" class=\"wp-image-316\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/ai-act-provider-vs-data-vendor-duties.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/ai-act-provider-vs-data-vendor-duties-300x150.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/ai-act-provider-vs-data-vendor-duties-1024x512.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/ai-act-provider-vs-data-vendor-duties-768x384.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/ai-act-provider-vs-data-vendor-duties-1536x768.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">Provider and data ven\u00addor lanes: the provider owns risk man\u00adage\u00adment and doc\u00adu\u00admen\u00adta\u00adtion; the ven\u00addor hands over con\u00adsent records, labels and QA evi\u00addence.<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-table\"><table><thead>\n<tr><th>Task<\/th><th>Provider<\/th><th>Data ven\u00addor<\/th><\/tr>\n<\/thead>\n<tbody>\n<tr><td>Intend\u00aded pur\u00adpose and data needs<\/td><td>Defines and signs off<\/td><td>Turns needs into a col\u00adlec\u00adtion spec<\/td><\/tr>\n<tr><td>Risk man\u00adage\u00adment (Arti\u00adcle 9)<\/td><td>Owns the risk sys\u00adtem<\/td><td>Flags data risks it sees<\/td><\/tr>\n<tr><td>Col\u00adlec\u00adtion and con\u00adsent<\/td><td>Sets law\u00adful basis and rules<\/td><td>Runs col\u00adlec\u00adtion, keeps con\u00adsent records<\/td><\/tr>\n<tr><td>Anno\u00adta\u00adtion and label\u00ading<\/td><td>Approves guide\u00adlines<\/td><td>Labels to ver\u00adsioned guide\u00adlines<\/td><\/tr>\n<tr><td>Qual\u00adi\u00adty checks<\/td><td>Sets accep\u00adtance cri\u00adte\u00adria<\/td><td>Runs QA, shares reports<\/td><\/tr>\n<tr><td>Bias exam\u00adi\u00adna\u00adtion<\/td><td>Owns analy\u00adsis and fix\u00ades<\/td><td>Sup\u00adplies cov\u00ader\u00adage data and meta\u00adda\u00adta<\/td><\/tr>\n<tr><td>Spe\u00adcial-cat\u00ade\u00adgo\u00adry data (Arti\u00adcle 4a)<\/td><td>Process\u00ades only under the six con\u00addi\u00adtions<\/td><td>Should not receive it unless coun\u00adsel con\u00adfirms<\/td><\/tr>\n<tr><td>Tech\u00adni\u00adcal doc\u00adu\u00admen\u00adta\u00adtion<\/td><td>Com\u00adpiles and keeps it<\/td><td>Deliv\u00aders the Evi\u00addence Pack files<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The Arti\u00adcle 4a row mat\u00adters most for plan\u00adning. Because spe\u00adcial-cat\u00ade\u00adgo\u00adry data must not reach oth\u00ader par\u00adties, decide ear\u00adly where bias test\u00ading on sen\u00adsi\u00adtive attrib\u00adut\u00ades will hap\u00adpen. Often that is inside the provider\u2019s own envi\u00adron\u00adment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Write the split into your con\u00adtract, nam\u00ading each Evi\u00addence Pack file and its for\u00admat. A <a href=\"https:\/\/www.graveiensai.com\/blog\/ai-risk-management-frameworks\/\">risk man\u00adage\u00adment frame\u00adwork<\/a> helps you con\u00adnect data evi\u00addence to wider con\u00adtrols.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How does GDPR overlap with AI Act training data rules?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">GDPR and the AI Act apply side by side. GDPR asks whether you may process per\u00adson\u00adal data at all, and how you respect peo\u00adple\u2019s rights. The AI Act asks whether the data is good enough and fair enough for a high-risk use. Doc\u00adu\u00admen\u00adta\u00adtion and spe\u00adcial-cat\u00ade\u00adgo\u00adry safe\u00adguards sit in both.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"900\" src=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/gdpr-vs-ai-act-training-data.webp\" alt=\"Venn diagram comparing GDPR and the EU AI Act for training data, overlapping on documentation and special-category safeguards\" class=\"wp-image-317\" srcset=\"https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/gdpr-vs-ai-act-training-data.webp 1600w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/gdpr-vs-ai-act-training-data-300x169.webp 300w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/gdpr-vs-ai-act-training-data-1024x576.webp 1024w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/gdpr-vs-ai-act-training-data-768x432.webp 768w, https:\/\/www.graveiensai.com\/blog\/wp-content\/uploads\/2026\/11\/gdpr-vs-ai-act-training-data-1536x864.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\"><figcaption class=\"wp-element-caption\">GDPR cov\u00aders law\u00adful basis and data sub\u00adject rights; the AI Act cov\u00aders data qual\u00adi\u00adty and bias; both require doc\u00adu\u00admen\u00adta\u00adtion and spe\u00adcial-cat\u00ade\u00adgo\u00adry safe\u00adguards.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The Euro\u00adpean Data Pro\u00adtec\u00adtion Board (EDPB) adopt\u00aded Opin\u00adion 28\/2024 on AI mod\u00adels on 18 Decem\u00adber 2024. It said legit\u00adi\u00admate inter\u00adest can work as a legal basis only if the pro\u00adcess\u00ading is strict\u00adly nec\u00ades\u00adsary and the bal\u00adanc\u00ading of rights is respect\u00aded. It also warned that unlaw\u00adful\u00adly processed train\u00ading data could affect the law\u00adful\u00adness of a mod\u00adel\u2019s deploy\u00adment, unless the mod\u00adel is duly anonymized. So the con\u00adsent trail is a deploy\u00adment risk, not just paper\u00adwork.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For speech, image and video col\u00adlec\u00adtion, explic\u00adit par\u00adtic\u00adi\u00adpant con\u00adsent is usu\u00adal\u00adly the clean\u00adest route. Our <a href=\"https:\/\/www.graveiensai.com\/blog\/speaker-consent-form-template\/\">speak\u00ader con\u00adsent form tem\u00adplate<\/a> shows the fields a con\u00adsent record should cap\u00adture.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What about general-purpose AI models?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">GPAI providers face a dif\u00adfer\u00adent data duty. Arti\u00adcle 53(1)(d) requires a pub\u00adlic sum\u00adma\u00adry of the con\u00adtent used to train the mod\u00adel, using a tem\u00adplate from the AI Office. The Com\u00admis\u00adsion pub\u00adlished that tem\u00adplate on 24 July 2025. GPAI oblig\u00ada\u00adtions have applied since 2 August 2025.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As of Novem\u00adber 2026, the Com\u00admis\u00adsion time\u00adline shows GPAI enforce\u00adment start\u00aded on 2 August 2026. Data sup\u00adpli\u00aders to GPAI devel\u00adop\u00aders should expect ques\u00adtions on source types, col\u00adlec\u00adtion peri\u00adods and licens\u00ading, so keep them in the prove\u00adnance record.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Common mistakes when evidencing Article 10<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Treat\u00ading the Omnibus as a pause.<\/strong> Data col\u00adlect\u00aded today still feeds the sys\u00adtems due in 2027.<\/li>\n\n\n<li><strong>Assum\u00ading the ven\u00addor car\u00adries com\u00adpli\u00adance.<\/strong> The provider owns Arti\u00adcle 10. Con\u00adtracts should define what evi\u00addence the ven\u00addor must deliv\u00ader.<\/li>\n\n\n<li><strong>Los\u00ading the orig\u00adi\u00adnal pur\u00adpose.<\/strong> Reused per\u00adson\u00adal data with\u00adout its orig\u00adi\u00adnal col\u00adlec\u00adtion pur\u00adpose is hard to defend under 10(2)(b).<\/li>\n\n\n<li><strong>Unlogged guide\u00adline changes.<\/strong> If label\u00ading rules changed mid-project with\u00adout a log, your prepa\u00adra\u00adtion record breaks.<\/li>\n\n\n<li><strong>One-off bias checks.<\/strong> Bias exam\u00adi\u00adna\u00adtion should be repeat\u00aded when data, labels or the intend\u00aded pur\u00adpose change.<\/li>\n\n\n<li><strong>Send\u00ading sen\u00adsi\u00adtive attrib\u00adut\u00ades to ven\u00addors.<\/strong> Under Arti\u00adcle 4a, spe\u00adcial-cat\u00ade\u00adgo\u00adry data used for bias work should not trav\u00adel to oth\u00ader par\u00adties.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">A quick refresh\u00ader on <a href=\"https:\/\/www.graveiensai.com\/blog\/what-is-training-data\/\">what train\u00ading data is<\/a>, and how it dif\u00adfers from val\u00adi\u00adda\u00adtion and test data, helps teams avoid mix\u00ading these splits.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Graveiens AI approaches Article 10-ready data<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Graveiens AI col\u00adlects and pre\u00adpares train\u00ading data for AI teams in the US and EU. We do not give legal sign-off. We own the part a data part\u00adner can: con\u00adsent\u00aded data with the evi\u00addence attached.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Explic\u00adit-con\u00adsent col\u00adlec\u00adtion.<\/strong> Our <a href=\"https:\/\/www.graveiensai.com\/data-collection\">data col\u00adlec\u00adtion<\/a> work\u00adflow runs par\u00adtic\u00adi\u00adpant onboard\u00ading, record\u00ading and cap\u00adture man\u00adage\u00adment, meta\u00adda\u00adta tag\u00adging and QA, with con\u00adsent cap\u00adtured up front.<\/li>\n\n\n<li><strong>Ver\u00adsioned label\u00ading.<\/strong> Our <a href=\"https:\/\/www.graveiensai.com\/data-annotation\">data anno\u00adta\u00adtion<\/a> teams work to writ\u00adten guide\u00adlines with logged changes.<\/li>\n\n\n<li><strong>Inde\u00adpen\u00addent checks.<\/strong> <a href=\"https:\/\/www.graveiensai.com\/data-validation\">Data val\u00adi\u00adda\u00adtion<\/a> adds a sec\u00adond QA lay\u00ader and a report you can file.<\/li>\n\n\n<li><strong>Cov\u00ader\u00adage.<\/strong> We work in 25+ lan\u00adguages, includ\u00ading Indi\u00adan and Euro\u00adpean lan\u00adguages such as Ital\u00adian.<\/li>\n\n\n<li><strong>Process dis\u00adci\u00adpline.<\/strong> Graveiens AI is ISO 9001 cer\u00adti\u00adfied and bills on approved deliv\u00ader\u00adables.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1762000000000\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does the EU AI Act apply to US companies?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes, if they place AI sys\u00adtems or gen\u00ader\u00adal-pur\u00adpose AI mod\u00adels on the EU mar\u00adket, or their sys\u00adtem\u2019s out\u00adput is used in the EU. Where the com\u00adpa\u00adny is based does not decide scope. A US provider sell\u00ading a high-risk hir\u00ading or cred\u00adit tool to EU cus\u00adtomers must meet Arti\u00adcle 10 for its train\u00ading, val\u00adi\u00adda\u00adtion and test\u00ading data.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1762000000001\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">When do Article 10 requirements start to apply?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>After the Dig\u00adi\u00adtal Omnibus on AI, Arti\u00adcle 10 applies to Annex III high-risk sys\u00adtems from 2 Decem\u00adber 2027. For high-risk AI embed\u00added in prod\u00aducts cov\u00adered by Annex I, the date is 2 August 2028. Because train\u00ading data is col\u00adlect\u00aded well before launch, most teams should build their evi\u00addence dur\u00ading col\u00adlec\u00adtion, not after it.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1762000000002\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Does Article 10 apply to all AI systems?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. Arti\u00adcle 10 applies to high-risk AI sys\u00adtems only. Min\u00adi\u00admal-risk tools, such as spam fil\u00adters, are not bound by it. Even so, many buy\u00aders now ask for the same evi\u00addence in con\u00adtracts. For high-risk sys\u00adtems that do not train mod\u00adels, Arti\u00adcle 10(6) lim\u00adits the rules to test\u00ading data sets.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1762000000003\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can we use sensitive personal data to test for bias?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Pos\u00adsi\u00adbly, under Arti\u00adcle 4a, which replaced Arti\u00adcle 10(5). Providers may excep\u00adtion\u00adal\u00adly process spe\u00adcial cat\u00ade\u00adgories of per\u00adson\u00adal data where strict\u00adly nec\u00ades\u00adsary for bias detec\u00adtion and cor\u00adrec\u00adtion. Six con\u00addi\u00adtions apply, includ\u00ading no work\u00adable alter\u00adna\u00adtive such as syn\u00adthet\u00adic data, strict access con\u00adtrols, no shar\u00ading with oth\u00ader par\u00adties, and dele\u00adtion once the bias is fixed. GDPR still applies too.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1762000000004\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is the data vendor liable under Article 10?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The provider of the high-risk sys\u00adtem car\u00adries the Arti\u00adcle 10 duty, not the data ven\u00addor. How\u00adev\u00ader, Arti\u00adcle 25(4) requires providers and their sup\u00adpli\u00aders to agree in writ\u00ading on the infor\u00adma\u00adtion and help need\u00aded for com\u00adpli\u00adance. In prac\u00adtice, ven\u00addors should deliv\u00ader con\u00adsent records, prove\u00adnance, label\u00ading guide\u00adlines, QA reports and cov\u00ader\u00adage data with every deliv\u00adery.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1762000000005\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is the GPAI training data summary template?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>It is the AI Office tem\u00adplate that gen\u00ader\u00adal-pur\u00adpose AI mod\u00adel providers must use to pub\u00adlish a sum\u00adma\u00adry of their train\u00ading con\u00adtent under Arti\u00adcle 53(1)(d). The Com\u00admis\u00adsion pub\u00adlished it on 24 July 2025. It asks for infor\u00adma\u00adtion about the provider, the mod\u00adel and the main data sources used. It is sep\u00ada\u00adrate from Arti\u00adcle 10, which cov\u00aders high-risk sys\u00adtems.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\">Get Article 10-ready training data<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start small and judge the files your\u00adself. <a href=\"https:\/\/www.graveiensai.com\/contact-us\">Book a 20-minute scop\u00ading call<\/a> or ask us for the Arti\u00adcle 10 Evi\u00addence Pack check\u00adlist. Pilots are billed only on approved files.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:02024R1689-20260727\" rel=\"noopener\" target=\"_blank\">EUR-Lex: AI Act (Reg\u00adu\u00adla\u00adtion (EU) 2024\/1689), con\u00adsol\u00adi\u00addat\u00aded text as at 27 July 2026<\/a><\/li>\n\n\n<li><a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/timeline\/timeline-implementation-eu-ai-act\" rel=\"noopener\" target=\"_blank\">Euro\u00adpean Com\u00admis\u00adsion AI Act Ser\u00advice Desk: imple\u00admen\u00adta\u00adtion time\u00adline<\/a><\/li>\n\n\n<li><a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-presents-template-general-purpose-ai-model-providers-summarise-data-used-train-their\" rel=\"noopener\" target=\"_blank\">Euro\u00adpean Com\u00admis\u00adsion: GPAI train\u00ading con\u00adtent sum\u00adma\u00adry tem\u00adplate (24 July 2025)<\/a><\/li>\n\n\n<li><a href=\"https:\/\/www.edpb.europa.eu\/news\/edpb-opinion-on-ai-models-gdpr-principles-support-responsible-ai_en\" rel=\"noopener\" target=\"_blank\">EDPB: Opin\u00adion 28\/2024 on AI mod\u00adels (18 Decem\u00adber 2024)<\/a><\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">About the author<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Graveiens AI Edi\u00adto\u00adr\u00adi\u00adal Team.<\/strong> Our edi\u00adto\u00adr\u00adi\u00adal team writes about AI train\u00ading data, speech data and data com\u00adpli\u00adance for AI builders in the US and EU. The team works along\u00adside our data col\u00adlec\u00adtion, anno\u00adta\u00adtion and QA leads, so each guide reflects how real projects run.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>EU AI Act train\u00ading data require\u00adments explained: Arti\u00adcle 10 duties, new Omnibus dates, GDPR over\u00adlap and a 6\u2011file evi\u00addence pack. Book a scop\u00ading call.<\/p>\n","protected":false},"author":1,"featured_media":318,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[1],"tags":[39,40,38,25,41],"class_list":["post-319","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-article-10","tag-data-governance","tag-eu-ai-act","tag-gdpr","tag-training-data"],"_links":{"self":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/319","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/comments?post=319"}],"version-history":[{"count":1,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/319\/revisions"}],"predecessor-version":[{"id":326,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/posts\/319\/revisions\/326"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/media\/318"}],"wp:attachment":[{"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/media?parent=319"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/categories?post=319"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.graveiensai.com\/blog\/wp-json\/wp\/v2\/tags?post=319"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}