Data and governance in high-risk AI: Article 10 of the Regulation explained by Guide 7
The data used to train a high-risk AI system determine a good part of its results. Guide 7 of the Spanish sandbox, updated in July 2026, explains Article 10 of the AI Regulation and the new Article 4a on the use of sensitive data to correct bias.
An artificial intelligence system is only as good as the data it was trained on. The European AI Regulation translates that into concrete obligations for high-risk systems in its Article 10, and Guide 7, "Data and data governance", of the Spanish regulatory sandbox pilot explains them with practical measures.
The guide is credited to the Ministry for Digital Transformation and the Civil Service. Its version 2.0 dates from 17 July 2026 and is adapted to the Digital Omnibus; version 1.0 is from 10 December 2025. Like the sandbox's other guides, it is not binding and neither replaces nor develops the rules.
We have already summarised two other guides in the series: the one on high-risk AI transparency and the one on high-risk practical cases.
What Article 10 says, according to the guide
| Paragraph | Content |
|---|---|
| 10.1 | Training, validation and testing data sets must meet the quality criteria in paragraphs 2 to 4 |
| 10.2 | They must be subject to appropriate data governance and management practices: design, data collection and origin, preparation, assumptions about what they measure, availability and quantity, bias analysis and mitigation, and detection of gaps |
| 10.3 | Data must be relevant, sufficiently representative, complete and, to the best extent possible, free of errors |
| 10.4 | They must take into account the geographical, contextual, behavioural or functional setting in which the system will be used |
| 10.6 | If the system is not based on training models, paragraphs 2 to 4 apply only to testing data |
The Omnibus change: sensitive data
The guide explains that paragraph 5 of Article 10 has been deleted by the Digital Omnibus, and that the processing of special categories of personal data to detect and correct bias moves to the new Article 4a of the Regulation.
According to the guide, that article allows processing them exceptionally, with safeguards: anonymisation or pseudonymisation, limited access, deletion once the bias has been corrected and a record in the register of processing activities.
For a firm advising on data protection, the change is relevant: processing sensitive data to correct bias now has a specific basis in the AI Regulation, but subject to strict conditions and without ceasing to apply the General Data Protection Regulation, as the guide itself recalls.
Who is obliged
- The provider is the main addressee of the measures.
- The deployer has no specific requirements in Article 10, according to the guide. But if it takes part in development or handles the training or testing data, it must apply the provider's measures. And if it controls the input data, Article 26.4 obliges it to ensure they are relevant for the intended purpose.
The measures it proposes
- Define the information requirements: what data the system needs.
- Collect from several sources, to avoid dependencies and bias, and fix a source of truth with the data owner.
- Control quality: completeness, consistency, representativeness.
- Prepare the data: standardise formats, sample, select features and label, with human oversight of automatic labelling.
- Analyse bias. The guide stresses that bias is not necessarily an error, but an imbalance that must be assessed in context.
- Control access and versions of the data and document their provenance and the presence of personal data.
- Manage deletion of data.
- Anonymise whenever possible; if that prevents detecting bias, pseudonymise and justify it.
- Document the measures, their application and who is responsible.
- Use the self-assessment questionnaire associated with the guide.
Usefulness for lawyers
In procurement. The guide's measures are a good list of questions for the provider of a high-risk system: where the data come from, how their quality has been controlled and what has been done about bias.
In litigation. When a decision supported by an AI system harms a person, data quality is one of the first questions to examine. It fits with the rules of Law 15/2022 on algorithmic discrimination, which we explain in the analysis of its Article 23.
More analysis in Legal AI.
Fuentes
- Ministerio para la Transformación Digital y de la Función Pública. Guía 7. Datos y gobernanza del dato, versión 2.0, 17 de julio de 2026 (PDF). Accessed 18 October 2026.
The specific data in this article come from the official sources cited.
