Topic Contested in court

Data Governance for AI

The AI Act's section on 'Data and data governance' requires specific provisions for managing training data, validation data, and test data in AI systems. This concept is distinct from general data protection and deserves its own topic to capture AI-specific data governance requirements including data quality, documentation, and management practices.

41 linked items 10 Laws6 Guidance4 News21 Literature

Overview

15 sources · Sep 25, 2026

Legal Framework

Data governance for AI is primarily governed by Article 10 of the AI Act, which imposes mandatory data governance requirements on high-risk AI systems that use model training techniques. Article 10(1) establishes that such systems must be developed using training, validation, and testing datasets meeting specific quality criteria. Article 10(2) then enumerates eight governance dimensions, ranging from design choices and data provenance to bias detection and gap identification.

The core obligation is both procedural and substantive:

"Training, validation and testing data sets shall be subject to data governance and management practices appropriate for the intended purpose of the high-risk AI system."
— AI Act Art. 10(2)

Recital 67 elaborates the rationale: high-quality data is essential to ensure that high-risk AI systems perform as intended, operate safely, and do not become sources of prohibited discrimination. The quality bar is concrete:

"Data sets for training, validation and testing, including the labels, should be relevant, sufficiently representative, and to the best extent possible free of errors and complete in view of the intended purpose of the system."
— AI Act Recital 67

For general-purpose AI models, Recital 107 adds a transparency obligation: providers must publish a sufficiently detailed summary of training content, balancing comprehensiveness against trade secret protection.

Key Developments

The EDPB's Opinion 28/2024 (adopted 17 December 2024) provides the most granular supervisory guidance to date on data protection aspects of AI model training. It identifies specific evaluation areas for supervisory authorities examining data preparation phases, including pseudonymisation considerations, data minimisation strategies, and filtering processes. Critically, the Opinion acknowledges that personal data may remain "absorbed" in model parameters even when the model is not designed to output such data — meaning data governance obligations extend beyond the training dataset into the model itself.

The EDPB-EDPS Joint Opinion 03/2021 on the Data Governance Act frames the broader regulatory environment, emphasizing that personal data protection is "an essential and integral element of the trust individuals and organizations should have in the development of the digital economy." This positions AI-specific data governance not as a standalone regime but as operating within — and reinforced by — the GDPR framework.

For practical compliance, the EDPB's evaluation framework in Opinion 28/2024 is instructive. Supervisory authorities are directed to examine:

"the data minimisation strategies and techniques employed to restrict the volume of personal data included in the training process"
— EDPB Opinion 28/2024 §45

This establishes a clear expectation that data governance for AI must include demonstrable minimisation efforts, not merely documentation of what was used.

Status of the Debate

This topic is actively contested. The AI Act's Article 10 requirements are newly legislated and have not yet been tested in enforcement or judicial proceedings. The doctrinal tension centers on the intersection of AI Act data governance obligations with GDPR lawful basis requirements — particularly whether Article 10's bias mitigation mandates (which may require retaining sensitive data to detect and correct disparities) conflict with GDPR data minimisation principles. The EDPB's recognition that personal data persists in model parameters further complicates the boundary between training data governance and ongoing processing obligations. No court has yet ruled on these tensions. Resolution will likely come through the first wave of AI Act enforcement actions and any preliminary references to the CJEU on the interaction between Article 10 and Article 5 GDPR.

Practical Guidance

Map every dataset to Article 10(2) elements: Document design choices, data origin, collection purpose, preparation operations, assumptions, suitability assessments, bias examination, mitigation measures, and identified gaps — each as a distinct governance artifact traceable to Art. 10(2)(a)–(h).
Implement bias detection before deployment, not after: Article 10(2)(f)–(g) require examination for biases likely to affect health, safety, or fundamental rights, plus appropriate mitigation measures. Pay particular attention to feedback loops where outputs influence future inputs.
Apply data minimisation demonstrably: Per EDPB Opinion 28/2024, record decisions on pseudonymisation, filtering, and volume restriction. Where minimisation is not applied, document the rationale tied to the intended purpose.
Maintain provenance transparency for personal data: Article 10(2)(b) requires documenting the original purpose of data collection when personal data is involved — ensure this metadata persists through the entire data pipeline.
Prepare the training data summary for GPAI models: Under Recital 107, providers of general-purpose AI models must publish a sufficiently detailed summary of training content. Draft this in narrative form, listing main data collections while protecting trade secrets, before the AI Office template is finalized.