The Spanish Agency for the Supervision of Artificial Intelligence (AESIA) has updated Guide No. 7 of the Spanish AI regulatory sandbox. The Guide covers Article 10 of the AI Act, Data and Data Governance. It was first published in December 2025 and has been revised to reflect the amendments introduced by the Digital Omnibus. It follows Guide No. 6 on Human Oversight and addresses the data foundations on which high-risk AI systems depend. The Guide is non-binding and intended primarily for providers. Its measures also apply to deployers where they participate in system development or exercise control over the input data.

Article 10 applies to high-risk AI systems that use techniques involving the training of AI models. These systems must be developed on the basis of training, validation and testing datasets that meet specified quality requirements. The datasets must be subject to appropriate data governance and management practices covering:

their design and collection;
their preparation and the assumptions made about them;
their availability, quantity and suitability;
bias analysis;
the identification and remediation of data gaps and shortcomings.

The datasets must be relevant, sufficiently representative, as far as possible free of errors and complete. They must have appropriate statistical properties in view of the intended purpose of the system. Where necessary, they must also reflect the geographical, contextual, behavioural and functional environment in which the system will operate. Following the Digital Omnibus, these requirements will apply from 2 December 2027 for high-risk systems listed in Annex III and from 2 August 2028 for those covered by Annex I.

Data governance as a lifecycle process

The Guide treats data governance as a lifecycle process rather than as a single quality check. It defines data governance as the set of policies, procedures, processes and standards used to ensure that the data used for training, validation and testing:

are adequate and relevant;
are sufficiently representative;
meet the required quality and completeness criteria.

The practical objective is a structured process that runs in stages:

identifying the information needed for the system’s intended purpose;
collecting the data;
preparing the data;
assessing quality and analysing bias;
where necessary, improving the underlying datasets.

The Guide also adds some elements not stated separately in Article 10, such as data transformation and sampling, because they are necessary for a coherent data-governance framework.

Identifying the information needed

The first step is to determine what information the AI system actually needs. Data requirements should derive from the system’s intended purpose rather than from the simple availability of data. The Guide uses a smart insulin pump as an example throughout. The pump’s objective is to determine the amount of insulin a diabetic patient needs at a given time, so the relevant data may include blood glucose levels, heart rate and blood oxygen levels. The example illustrates a basic principle: data governance starts before data are collected, because the organisation must first identify which information the intended task requires.

Data collection

The source of the data matters, because the accuracy and quality of the resulting AI system may depend on the representativeness and sufficiency of those sources. A single source can create dependencies that stay invisible during development and only become apparent when the system meets data from a different source or context. The Guide’s second example is a biometric attendance system. A facial-recognition system trained predominantly on images of white men could perform worse when identifying people of other genders or racial backgrounds. Data collection must therefore be assessed in light of the intended purpose, taking account of applicable data-protection requirements.

Data preparation

Once collected, data must be prepared for use. The Guide identifies a series of possible operations:

annotation and labelling;
cleaning and updating;
transformation and aggregation;
sampling;
feature creation and selection;
data enrichment.

Not every operation will be necessary in every AI system. The right process depends on the nature of the data, the intended purpose of the system and the quality problems identified during assessment. Data preparation is itself part of the governance process and should be documented, not treated as an invisible technical step.

Data quality

Data quality is a central and continuous requirement. The Guide defines it as the degree to which data are fit for the purpose for which they were collected or defined. Measuring and improving data quality is not optional; it should always form part of an adequate data-governance system. Organisations should first determine which quality dimensions are relevant to each dataset, then assess them using an appropriate methodology. The Guide’s annexes list, among others:

completeness and representativeness;
auditability and credibility;
consistency;
relevance;
diversity.

The appropriate dimensions depend on the role the data play in the system.

More data do not necessarily mean better data. Organisations must assess the availability, quantity and suitability of the datasets for the intended purpose. A dataset may be extensive yet fail to provide the information the system needs. It may also be large enough but unrepresentative of the people, environments or circumstances in which the system will operate. The assessment is therefore contextual and purpose-driven: data must be sufficient for the task and appropriate to the population and environment concerned.

Representativeness matters most where an AI system is intended to affect different groups of people. Article 10 requires the statistical properties of datasets to be appropriate, including, where applicable, with regard to the persons or groups of persons in relation to whom the system is intended to be used. The Guide therefore links data quality directly to the context of deployment. Geographical, behavioural and functional characteristics may all need to be reflected where they are relevant to the intended purpose.

Bias, data gaps and special categories of data

Article 10 requires providers to examine datasets for biases that could:

affect people’s health or safety;
negatively affect fundamental rights;
lead to discrimination prohibited under Union law.

Where such biases are identified, appropriate measures must be adopted to detect, prevent and mitigate them. The Guide treats bias not simply as a statistical problem but as a potential source of legal and fundamental-rights risks. Its annexes provide examples of sources of bias, assessment techniques and possible treatment measures.

Organisations should also identify missing or inadequate information that could prevent compliance with the AI Act, and decide how to address it. Options include:

collecting additional data;
improving existing datasets;
enriching them with information from other sources;
changing the way data are prepared.

The process is iterative: deficiencies found during quality or bias assessment may require a return to the collection or preparation stage.

The processing of special categories of personal data receives particular attention. The AI Act allows such data to be processed where this is strictly necessary for monitoring, detecting and correcting bias, but only with appropriate safeguards for the fundamental rights and freedoms of individuals. Following the Digital Omnibus, this legal basis is now set out in the new Article 4a of the AI Act. Article 4a extends it beyond high-risk systems and keeps the requirement of appropriate safeguards. The Guide treats this as a specific and sensitive governance issue rather than as a general exemption from data-protection law. Providers must therefore consider the applicable data-protection framework and put in place safeguards appropriate to the processing concerned.

Providers and deployers

Article 10 is primarily directed at providers, because its data-governance requirements concern the development of the AI system. Deployers do not generally assume the provider’s Article 10 obligations merely because they use the system. The requirements do apply to a deployer’s activity, however, where the deployer:

participates in development;
is responsible for training or testing data;
exercises control over input data.

In particular, Article 26 requires deployers that exercise control over input data to ensure that those data are relevant to the intended purpose of the high-risk AI system.

Documenting the lifecycle

Data governance is closely connected to the other requirements of the AI Act:

poor data quality can undermine accuracy and robustness;
inadequate representativeness can create fundamental-rights risks;
insufficient traceability can make errors difficult to investigate;
weak governance can compromise the effectiveness of human oversight and risk management.

Data governance should therefore not be treated as an isolated technical requirement, but integrated into the broader governance framework of the AI system.

The organisation should be able to explain:

why particular data were selected and where they came from;
how they were transformed or labelled;
which quality dimensions were assessed;
which biases or gaps were identified;
what measures were taken in response.

The technical documentation should capture these decisions and leave an evidentiary trail. As appropriate, that trail covers dataset design, sources and collection methods, preparation operations, quality controls, assumptions, representativeness, bias analysis, identified deficiencies and corrective measures. The Guide’s annexes support this with practical catalogues of:

data-collection methods;
quality dimensions and controls;
bias sources, assessment techniques and treatment measures.

What to do in practice

For providers and deployers working through Article 10, the practical sequence is:

define the information required by the intended purpose;
identify and collect appropriate data sources;
prepare and process the data;
assess their availability, quantity, relevance, completeness and representativeness;
measure and improve data quality;
analyse and mitigate relevant biases;
identify and address data gaps and deficiencies;
apply appropriate safeguards where special categories of personal data are processed;
document the decisions and controls applied throughout the lifecycle.

Where the deployer controls input data, the same logic applies to those data.

Data governance directly affects the reliability, fairness and legal compliance of an AI system, so Article 10 should not be treated as a one-off dataset assessment. The central question is whether the organisation can demonstrate, throughout the lifecycle of the system, that the data it relies on:

are appropriate for the intended purpose;
are sufficiently representative;
are adequately governed and of the required quality;
can support the system without creating unmanaged risks to health, safety or fundamental rights.

‍

‍