Recommended Free Tools
Data quality is becoming an AI requirement because the data used to train, validate and test a system shapes whether that system performs as intended and whether it can create risks for people. In the European Union, the AI Act makes this explicit for relevant high-risk AI systems. Article 10 sets dataset-quality and data-governance duties, and Article 17 places data controls inside the provider’s quality-management system. Good data is necessary for managing those risks, but on its own it does not prove that a system is safe or accurate.
What the EU AI Act asks of training, validation and testing data
The Act treats data as something to govern, not only something to check after a model has been built. Article 10 is the central provision. It concerns how the datasets used to train, validate and test a high-risk system were chosen, prepared and examined, and it links those choices to the system’s intended purpose and to the risks it can pose to people. Article 15 addresses how the system itself performs, and Article 17 addresses the organisation’s processes. Each answers a different question, and treating them as interchangeable is a common mistake.
As an Amazon Associate I earn from qualifying purchases.
Which systems the data duties cover
The data governance duties apply to relevant high-risk AI systems that fall within the Act’s legal scope. Whether a given product is in scope depends on the Act’s classification rules and on the operator’s role, not on whether it uses machine learning. Article 17 is addressed to providers of high-risk AI systems, and deployers carry their own obligations. Confirm your role and the system’s classification against the consolidated text before assuming which articles apply to you.
Why quality depends on purpose, not on a pass/fail score
A common assumption is that data quality means a dataset either passes a check or fails it. The Act’s wording points somewhere else. Quality is judged against what the system is for and where it will operate. Recital 67, as presented by the European Commission AI Act Service Desk, gives the rationale:
“High-quality data and access to high-quality data plays a vital role in providing structure and in ensuring the performance of many AI systems, especially when techniques involving the training of models are used, with a view to ensure that the high-risk AI system performs as intended and safely and it does not become a source of discrimination prohibited by Union law.”
Article 10 translates that aim into criteria for training, validation and testing datasets. They must be relevant, sufficiently representative, and, to the best extent possible, error-free and complete, all in view of the intended purpose. They must also have appropriate statistical properties, and the provider must consider the setting in which the system will be used.
Consider a hypothetical screening tool trained largely on records from one region and one customer segment. Its data could be clean, complete and statistically well behaved, and still be poorly suited to a different market or user group. Under the Act’s framing, that mismatch is a data-quality problem, because the data no longer fits the purpose and setting.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The governance questions Article 10 expects you to answer
Article 10 reaches back to how data was selected and prepared, not only to the finished dataset. The table maps each governance topic named in the Article to the question it raises and to a record that can answer it. The records column is practical advice, not a list the Act prescribes.
| Governance topic | Question to answer | Practical record to keep |
|---|---|---|
| Design choices | Why was this data and this approach selected for the system? | Design rationale tied to the intended purpose |
| Collection and origin | Where did each data source come from, and how was it collected? | Dataset inventory entry for each source |
| Preparation | What did labelling, cleaning, updating, enrichment or aggregation change? | Versioned preparation log |
| Assumptions | What does the dataset claim to measure, and does that hold for the intended users and setting? | Written statement of assumptions and their limits |
| Availability and suitability | Is there enough relevant data for the stated purpose? | Suitability assessment that lists known shortfalls |
| Bias and gaps | Which groups or contexts are missing or overrepresented, and what was done about it? | Bias review, mitigation record and open gap register |
An answer is only useful if someone who did not build the dataset can reconstruct from it why the data was used.
Where data controls sit: the quality-management system
Article 17 places data-management systems and procedures inside the quality-management system that providers of high-risk AI systems must operate. That placement matters. It turns data controls into a documented, repeatable process with owners and review points, rather than a cleaning step performed once before training. The Article’s list of data activities covers acquisition, collection, analysis, labelling, storage, filtration, mining, aggregation and retention, so the procedures should reach every stage where data is received, changed or kept.
Good data is necessary, but it does not prove a system works
Dataset quality addresses one input into system behaviour. Article 15 separately addresses appropriate accuracy, robustness and cybersecurity throughout the lifecycle. The table separates what each provision covers and what it leaves open.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Provision | What it governs | What it does not settle |
|---|---|---|
| Article 10 | Dataset selection, preparation, representativeness and bias examination | Whether the trained system is accurate or robust in operation |
| Article 15 | Accuracy, robustness and cybersecurity across the lifecycle | How the training, validation and test data was chosen and documented |
| Article 17 | The quality-management system, including data-management procedures | The technical performance of any individual dataset |
Provenance and privacy are part of data quality
Article 10 calls for information on data origin and, for personal data, the original collection purpose. That links data quality to privacy. A dataset gathered for one purpose and reused for AI training needs its provenance recorded, so the team can judge whether the reuse fits the system’s intended purpose. The OECD discusses AI data governance and privacy together, reflecting the view that the two are hard to separate in practice. The AI Act does not by itself settle whether a particular reuse is lawful under data-protection rules; that question needs its own assessment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Legal obligation and voluntary framework are different things
NIST describes its AI Risk Management Framework as voluntary. The AI Act sets obligations for systems within its legal scope. Because both address AI risk and data, they are easy to conflate, but they do different jobs.
| Dimension | EU AI Act | NIST AI Risk Management Framework |
|---|---|---|
| Status | Legal obligations for in-scope systems | Voluntary, as NIST describes it |
| Who it applies to | Actors with defined roles for systems in scope | Organisations that choose to use it |
| Practical use | Evidence for the Article 10 and Article 17 duties on in-scope systems | Structuring AI risk work; it is not a substitute for legal obligations |
Building the record: a working routine
The Act does not prescribe one tool or a numeric data-quality score. The routine below is practical implementation advice drawn from the requirements discussed above.
- Freeze and version every dataset. Give each training, validation and test set an identifier, an owner and a version, so that a model can be traced to the exact data it was built and tested on.
- Attach records at each change. A new source, a relabelling pass or a change to filtering or aggregation should update the inventory and preparation log before the data reaches a training run.
- Reopen the review when the setting changes. A new market, user group or operating environment means revisiting the intended-use and representation assumptions, not only retesting the model.
- Tie bias and gap findings to release decisions. Record which gaps remain open at release, who accepted them, and what monitoring is planned for the affected groups or contexts.
- Link data records to evaluation and quality-management records. Accuracy, robustness and cybersecurity test results should name the dataset versions they used, so the evidence can be read as one set.
Using outside certified compliance services
Recital 67 notes that third-party certified compliance services may be used, provided the Regulation’s data requirements are ensured. The recital names no provider, and this article does not recommend one. The practical test is whether a service can show that the data requirements in Articles 10 and 17 are actually met for your system. Check its qualifications, the scope of its certification and the geographies it covers before relying on it.
Scope and currency
The article-level reference pages used to prepare this explanation state that they reflect the consolidated EU AI Act text as of 27 July 2026, and they note amendments associated with the Digital Omnibus on AI. Treat the consolidated text published on EUR-Lex as the authority for any provision, and check it for the latest amendments before acting. This article does not set out application dates; verify them against official material rather than relying on secondary summaries.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
