High-Risk AI Data Governance and Bias Management

Govern training, validation and testing data for suitability, quality, representativeness and bias management.

Providers should apply this control to the data relevant to their high-risk AI system. Deployers should focus on input data under their control.

1. Record data sources, permitted uses, preparation steps and assumptions, and assign a data owner.
2. Define checks for relevance, completeness, errors and representation in the intended setting. Include the people or groups affected where relevant.
3. Examine harmful bias and material gaps, document mitigation and decide whether the data is fit for use. Protect sensitive data and separately assess any Article 4a processing route.
4. Reassess when datasets, populations or operating conditions change, and retain the decision history. The provider's training, validation and testing duties and the deployer's input-data duty are different. For systems not using model training, check the specific testing-data scope in Article 10(6).

Before relevant data is used; throughout development and operation as appropriate; after data, population, purpose or context changes.

Data-source register and preparation history Quality and representation criteria with test results Bias and gap assessments with mitigation decisions Approvals, unresolved limitations and change history Input-data checks for data controlled by a deployer

Sample a dataset or controlled input stream. Trace its source and preparation to the approved use, review results against the stated criteria and follow one identified bias or quality issue through remediation and recheck.