Article 10 and the anatomy of a file — Cours — Académie

What the law requires, who the obligation falls on, and how a file translates all that into 8 checkable points.

1What article 10 requires

The AI Act · art. 10 governs the training, validation, and testing data of high-risk AI systems (recruitment, credit, education, insurance… annex III). The datasets must be:

relevant, sufficiently representative, and, to the extent possible, free of errors and complete in view of their purpose;
endowed with appropriate statistical properties (including for the groups of persons concerned);
governed by data governance practices: collection, preparation, assumptions, examination of biases and their effects, identification of gaps.

The key switch to remember. The obligation targets the provider (who places the system on the market), not the mere deployer. But a deployer who substantially re-trains or adapts a model on its own data can become a provider — and inherit article 10.

2The file: 8 sections

A file translates article 10 into 8 checkable points. The expert works through them one by one (ph1→ph8):

ph1

Provenance

Where each source comes from, how it was collected.

ph2

Legal basis

GDPR basis + compatible purpose for the reuse.

ph3

Representativeness

The data covers the population targeted by the model.

ph4

Quality

Duplicates, missing values, errors, outliers.

ph5

Sensitive data

Presence, justification, safeguards.

ph6

Bias

Gaps between groups: measured, read, justified or mitigated.

ph7

Gaps

What is missing and the plan to fill it.

ph8

Governance & updates

Who maintains it, how often, traceability.

Signing means attesting that all eight hold up. If a single point gives way, the file goes back (tier 4).

3Actors and scope: who is concerned

The AI Act distinguishes several actors along the chain:

Provider — places the system on the market or puts it into service under its own name. It is the provider who carries article 10.
Deployer — uses the system. It has its own obligations (human oversight, use in line with the instructions, informing individuals) but not article 10.
Importer / distributor — bring the system into or move it within the EU; they check that the provider is compliant before it is placed on the market.

Two switches that trigger article 10. A deployer who substantially re-trains or adapts a model on its own data becomes a provider for the part it modifies. Likewise, a substantial modification of a system already in service (affecting compliance, purpose, or performance) reopens the obligations: compliance is never acquired "for life."

General-purpose models. When a large general-purpose model is integrated into a high-risk system (e.g., a CV-screening tool), the art. 10 file targets the data of that system — it is the provider of the high-risk system who builds it, not the provider of the base model (who has its own separate obligations).

What counts as "high-risk"?

The scope of article 10 is the high risk of annex III: employment (screening applications), credit (creditworthiness assessment), education (assessment/access), essential services, etc. To be distinguished: limited risk (chatbots, deepfakes → transparency obligation), minimal risk (spam filters, movie recommendations → free), and the unacceptable (generalized social scoring → banned). Being able to classify the risk shapes everything that follows: no high risk, no art. 10 file.

4The data, in detail

Three datasets, three roles

Article 10 covers training (the model learns), validation (hyperparameters are tuned), and testing (final performance is evaluated on data never seen before). Confusing validation and testing is a classic mistake.

The required qualities

Relevant (useful to the purpose) ≠ representative (covers the population and sub-groups targeted): two distinct requirements. A dataset can be relevant and yet poorly cover certain groups.
Free of errors "to the extent possible" — not "zero errors." What matters is the documented approach (how errors were sought and handled), not a claim of perfection. Be wary of "our dataset is perfect."
Complete = covers the relevant cases and sub-populations, with no major gap — not "all the data in the world" nor "zero missing values" (that's quality, ph4).
Appropriate statistical properties, including for the groups of persons targeted (the distribution correctly reflects the sub-populations).

Note: article 10 does not require full anonymization — quite the opposite, certain sensitive data must be processable in order to measure bias (section ph5; the legal basis, art. 10§5, is detailed in the GDPR theme).

Performance ≠ compliance. "95% accuracy, so our data must be good" is a flawed argument: a well-performing model can rest on biased data (it performs well on a biased distribution), and a high overall score can hide a poor result on a sub-population. Article 10 is about the data, not a model metric.

Data governance art. 10(2)

Beyond the state of the data, the article requires governing and documenting: the design choices and collection assumptions; the collection and origin (provenance, rights/licenses — a dataset bought from a broker isn't "legal because it was paid for": provenance and legal basis must be checked); the preparation operations (annotation, cleaning, deduplication, handling of missing values); the examination of biases and the identification of gaps. Governance (the mechanism) is distinct from quality (the state of the data at a given moment).

5Proof, documentation, and duration

Demonstrate, don't just assert

A file must be documented and auditable: compliance must be demonstrable to a third party (authority, client), not merely asserted. To this end, the provider maintains technical documentation — the data file is part of it. Complying with the applicable harmonized standards gives a presumption of conformity (a proof shortcut), not an exemption.

Compliance ages

Representativeness degrades over time (drift, obsolescence): the population and the uses evolve. Hence the governance & update section (ph8): review frequency, monitoring, and re-certification whenever a substantial change (data, purpose, regulation) requires it.

And the signature? It attests that the 8 sections hold up — a binding act that carries commitment. The how (signature bar, referral, immutability) is the subject of the "Judgment" tier.