What does EU AI Act Article 10 require for training data?

Article 10 of Regulation (EU) 2024/1689 requires providers of high-risk AI systems to document training data governance practices: design choices, collection processes and data origin, preparation operations (cleaning, labelling, annotation), statistical bias assessments, and known dataset limitations. These obligations apply fully from August 2026.

Which AI systems are classified as high-risk under the EU AI Act?

High-risk AI systems include those used in biometric identification, critical infrastructure, education, employment, essential private and public services, law enforcement, migration management, and administration of justice, as listed in Annex III of Regulation (EU) 2024/1689. Misclassifying your system as non-high-risk does not remove the legal obligation.

What record-keeping does Article 12 of the EU AI Act mandate?

Article 12 requires high-risk AI providers to implement automatic logging of events throughout the system lifecycle, sufficient to enable post-hoc traceability and identify risks. Logs must be retained for at least the lifetime of the system or six months after market placement, whichever is longer, and made available to competent authorities on request.

How should AI companies document training data provenance?

Provenance documentation should record: where each dataset originated, who held rights at acquisition, what license terms applied, every transformation applied before training, and a hash or cryptographic seal of the dataset at the time of use. A qualified timestamp creates an immutable, court-admissible record of when each dataset version was ingested.

When do EU AI Act obligations apply to general-purpose AI models?

General-purpose AI model (GPAI) obligations under Chapter V of Regulation (EU) 2024/1689 applied from August 2025, one year after the regulation entered into force on 1 August 2024. High-risk AI system requirements apply fully from August 2026. Systemic-risk GPAI providers face additional transparency and adversarial testing obligations from August 2025.

AI Technology

EU AI Act数据治理：AI企业2026年须记录的内容

Swiss Trust Layer Editorial Team · Legal Content

2026年6月12日 10 分钟阅读最后更新 2026年9月8日

返回博客

In short

Regulation (EU) 2024/1689依据第10条和第12条对AI企业施加了严格的数据治理义务。以下是您的文档必须涵盖的确切内容——以及时间节点。

2025年春，阿姆斯特丹一家AI初创公司的首席技术官收到了荷兰数据保护局（Autoriteit Persoonsgegevens）的正式查询：根据第10条提交训练数据集的来源记录。团队已经工作了两年。数据集是存在的。文档却不存在。来源记录散落在Notion页面、已归档的Slack消息线程和三位前工程师也曾使用过的共享硬盘中。监管机构给了他们30天时间。根据《欧盟人工智能法》第99(3)条，罚款上限为1500万欧元或全球年营业额的3%，以较高者为准。

《欧盟人工智能法》，即法规（EU）2024/1689，于2024年8月1日生效。对于在欧洲构建AI产品的团队来说，这一日期标志着合规倒计时的开始。通用目的AI模型义务自2025年8月起适用。高风险AI系统要求自2026年8月起全面适用。构建文档基础设施的窗口期就是现在。本文重点介绍近期最可能产生法律风险的条款：第10条的数据治理要求、第12条的记录保存义务，以及证明训练数据来源的实际挑战。

查看关于人工智能内容所有权的完整指南

使用 Swiss Trust Layer AG 保护您的作品

使用由 Swisscom Trust Services 支持的司法认可 e-Seal 封存您的知识产权。

预约免费演示

相关文章