EU AI Act Article 10 · Data and data governance
Article 10 of the EU AI Act requires high-risk AI providers to govern training, validation, and testing data: quality criteria, examination for bias and protected attributes, and representativeness for the intended purpose. Datasets must be appropriate to the geographical, contextual, behavioural or functional setting in which the system is intended to be used (Art. 10(4)). Enforcement was deferred to 2 December 2027 by the Digital Omnibus, which was adopted in June 2026 and awaits publication in the Official Journal.
Source: Regulation (EU) 2024/1689 (EU AI Act), CELEX:32024R1689.
In development:License Compliance Checker partially addresses Article 10. It surfaces training-data licence and provenance risk via the dataset risk registry (top-50 known datasets flagged with critical / high / medium tiers). Full Article 10 coverage (dataset lineage across runs, bias examination, statistical-property characterisation) is the scope of TraceForge, which is in development. LCC today is the first half of the toolchain.
Building Article 10 evidence with License Compliance Checker
License Compliance Checker partially addresses Article 10. It surfaces training-data licence and provenance risk via the dataset risk registry (top-50 known datasets flagged with critical / high / medium tiers). Full Article 10 coverage (dataset lineage across runs, bias examination, statistical-property characterisation) is the scope of TraceForge, which is in development. LCC today is the first half of the toolchain.
License Compliance Checker produces a structured artefact suitable for inclusion in your Annex IV technical documentation pack. It is not a substitute for notified-body conformity assessment.
Install in 30 seconds
bashpip install license-compliance-checkerFrequently asked questions
Direct answers to common questions about Article 10 and how License Compliance Checker addresses it. Regulatory citations reference EUR-Lex CELEX:32024R1689.
- What does EU AI Act Article 53 require?
- Providers of general-purpose AI models must keep up-to-date Annex XI technical documentation, put a copyright-compliance policy in place aligned with Directive (EU) 2019/790 Article 4(3), and publish a sufficiently detailed training-data summary using the AI Office template. Source: Regulation (EU) 2024/1689 Article 53(1).
- Is LCC a substitute for legal review?
- No. LCC produces audit evidence (SBOMs, license-conflict reports, training-data risk registries) that legal counsel reviews. The tool does not provide legal opinions or substitute for qualified counsel.
- What ecosystems and file formats does LCC scan?
- Eight package ecosystems (Python, Node.js, Go, Rust, Ruby, Java, .NET, HuggingFace) plus AI model files in GGUF and ONNX formats, covering Ollama and llama.cpp deployments. The full feature list is in the documentation.
- Does LCC detect AI model licenses, not just code dependencies?
- Yes. LCC includes an AI license registry covering RAIL, OpenRAIL, Llama, Gemma, Mistral, BigScience and other AI-specific licenses. It also detects HuggingFace model references in Python, YAML, and JSON code (e.g. `from_pretrained`, `model=`).
- Can LCC generate the AI Office training-data summary template?
- LCC produces inputs for that summary: a per-model training-data manifest with provenance and licensing. The final AI Office template completion is a documentation task; LCC supplies the structured data needed to fill it. Treat the output as evidence, not as the certified summary itself.
- What is the penalty for non-compliance with Article 53?
- Up to €15M or 3% of global annual turnover, whichever is higher, imposed by the European Commission under Article 101(1). Note that GPAI fines are Commission-imposed under Art. 101, distinct from the Article 99 fines that member-state market-surveillance authorities impose for high-risk-system violations.
- Is LCC really free? What is the catch?
- LCC is Apache 2.0 licensed, free for any use including commercial. There is no telemetry, no remote calls, no enterprise tier locked behind paywalls. The "catch" is that you run it on your own infrastructure and review the output yourself.
- Does LCC scan transitive dependencies?
- Yes, when a lock file is present (poetry.lock, package-lock.json, etc.). Without a lock file, LCC scans declared direct dependencies only and warns about the transitive gap.
When the findings land on a governance desk
Tools surface problems. Programmes solve them.
Training-data accountability traces upstream through providers, downstream through deployers. The Liability Ledger framework maps that supply chain end-to-end and pairs with the LCC + TraceForge toolchain when the toolchain ships in full.
Framework: Liability Ledger at AskAjay.ai, the advisory arm of AI Exponent LLC.
Explore the Liability Ledger framework →Other articles in the EU AI Act