← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act Article 10: data governance for LLM agents

Article 10 sets quality criteria for the data used to train, validate and test high-risk AI systems: appropriate data governance practices, relevance, representativeness, examination for possible biases, and identification of data gaps.

Teams building agents on top of a hosted model often read Article 10 and conclude it is the model vendor's problem. Partly true: the pre-training data is not yours. But a high-risk agent still depends on data you choose.

The data that is still yours

• Evaluation and test sets. The prompts and expected outcomes you use to decide the agent is good enough to ship.
• Fine-tuning data, if you fine-tune.
• Retrieval corpora. The documents a RAG agent reads shape its answers as much as the model does.
• Few-shot examples and system prompts, which act as a small, very influential training set.
• Production inputs used for improvement, once you feed real runs back into evaluation.

What to document

• Where each dataset came from, when it was collected and for what purpose.
• Preparation steps: cleaning, labelling, filtering, deduplication.
• The assumptions the data is supposed to represent (users, languages, edge cases).
• An examination for biases that could affect fundamental rights, and what you did about them.
• Known gaps and how the system behaves when it meets them.

Article 10(5) allows, under strict safeguards, processing of special categories of personal data where strictly necessary for bias detection and correction. If you rely on it, document the safeguards.

Connecting data to behaviour

Data governance becomes credible when you can show its effect on what the system does. If evaluation runs are recorded in the same signed format as production runs, you can show which dataset version a release was tested on, and replay those runs after a data change to see what moved.

The run log does not prove your dataset is representative. It proves which data the system was tested with and how it behaved, which is the half auditors usually find missing.

Check your own logs

Paste a Vetro ledger or an OpenTelemetry GenAI trace export into the free checker: it verifies integrity and shows which record-keeping obligations your evidence covers, in your browser. When you need something to hand to an auditor or a customer, the countersigned EU AI Act report costs 29 USD, one-off: an ed25519 counter-signature over your evidence plus a mapping to the articles, including an explicit list of what the log cannot show.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.