YTYK You think you know

Card 8 of 15 What high risk actually obliges ●●● Sharp edge

Data governance, and the article that permits special-category data

Training, validation and test sets must be relevant, sufficiently representative, and to the best extent possible free of errors and complete for the intended purpose, with examination for bias. Article 10(5) lets providers process special-category data specifically to detect and correct bias — subject to strict conditions.

Why it is like this

Bias cannot be measured in data from which the sensitive attribute has been removed. Without that permission, the regulation would require a test the GDPR forbade.

Not to be confused with

A requirement of perfect data. The standard is "to the best extent possible" and is judged against the intended purpose and the people the system will be used on.

In practice

Collecting ethnicity data solely to test a hiring model for disparate impact is permitted under 10(5) — with technical limits, access controls, and no onward use.

Source: Regulation (EU) 2024/1689 (AI Act) — Article 10. Read on .

Connects to

  • GDPR — Special-category data under Article 9 GDPR
Predict Check yourself

A provider needs ethnicity data to test a hiring model for bias, but holds none and has no consent. What does the AI Act say?

  1. Article 10(5) permits processing special-category data where strictly necessary to detect and correct bias, under strict safeguards.
  2. It is prohibited — special-category data may never be processed for model testing.
  3. It is permitted only with the explicit consent of each candidate.
  4. The AI Act is silent; only the GDPR governs it.
Show the answer

Article 10(5) permits processing special-category data where strictly necessary to detect and correct bias, under strict safeguards.

It is a deliberate exception, and a narrow one: strictly necessary, with safeguards, security measures and no reuse.