European UnionAI Act, Article 4a (processing of special categories of personal data for bias detection and correction)
Regulation (EU) 2024/1689, Article 4a
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force 58 days, effective 27 July 2026.
An AI governance rule binding public and private bodies.
As of 23 September 2026.
What it requires
- If you are a provider of a high-risk AI system, you may exceptionally process special categories of personal data to the extent strictly necessary to detect and correct bias under Article 10(2), points (f) and (g), provided all six conditions of Article 4a(1) are met: the bias cannot be effectively addressed with other data, including synthetic or anonymised data; the data is subject to technical re-use limits and state-of-the-art security, including pseudonymisation; the data is secured with strict access controls and documented access; the data is not transmitted, transferred, or otherwise accessed by other parties; the data is deleted once the bias is corrected or its own retention period ends, whichever comes first; and your records of processing activities under the General Data Protection Regulation (GDPR), the EU institutions data protection regulation, or the law enforcement directive state why the processing was strictly necessary and why other data could not achieve the same result.
- If you are a provider or deployer of any other AI system or model, or a deployer of a high-risk AI system, you may exceptionally process special categories of personal data under the same conditions, but only to the extent strictly necessary to detect and correct bias likely to affect health and safety, have a negative impact on fundamental rights, or lead to discrimination prohibited under Union law. This paragraph creates no obligation to conduct such bias detection and correction.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Who enforces it
Settledness
Operative text: Article 113, third paragraph, point (a), as amended, applies Chapters I and II from 2 February 2025 and carves out only Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b). Article 4a sits in Chapter I, so it applies once it exists, on 27 July 2026. Recital 9 says the Article 4a legal basis should apply from the AI Act's date of entry into application, which recital 40 gives as 2 August 2026. The row follows the operative text.
- As of
- 23 September 2026
- Open questions
- Does Article 4a apply from the Omnibus's entry into force on 27 July 2026, as Article 113, third paragraph, point (a), as amended, reads (it applies Chapter I from 2 February 2025 and names no exception for Article 4a), or from 2 August 2026, the general application date that recitals 9 and 40 of Regulation (EU) 2026/1744 point to?
What it reaches
How the hook was established
express
What makes it apply
Market targeting, Operator establishment, Place of effect
Obligation class
Governance, Security
What it makes you log
What the log must hold
Decision basis
Log retention
Paragraph 1, point (e): the special categories of personal data processed under this Article must be deleted once the bias has been corrected or the data's own retention period ends, whichever comes first. No fixed number of days, months, or years is stated.
- As of
- 23 September 2026
- Basis
- Purpose bound
- Prohibits retaining
- the special categories of personal data processed under this Article, once the bias has been corrected or the data's own separately-applicable retention period ends, whichever comes first
Logging duty
Paragraph 1, point (f), requires that the GDPR, EU institutions data protection regulation, or law enforcement directive records of processing activities include the reasons the processing of special categories of personal data was strictly necessary to detect and correct bias, and why that objective could not be achieved with other data. No comparable point appears in paragraph 2.
- Kind
- Explicit
- As of
- 23 September 2026
- Provision
- Article 4a(1), point (f)
- Trigger
- personal_data_processing
Who checks it
Audit expectation
none
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 4a, inserted into the AI Act by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026), is a conditional permission rather than a duty: it lets a provider of a high-risk AI system exceptionally process special categories of personal data where strictly necessary for the bias detection and correction the Article 10(2), points (f) and (g), data-governance duty requires, if all six conditions of paragraph 1 are met (no adequate substitute data, technical re-use limits and state-of-the-art security including pseudonymisation, strict access controls and documented access, no transmission to other parties, deletion once the bias is corrected or the data's own retention period ends, and a documented reason in the General Data Protection Regulation (GDPR) records of processing activities).
Paragraph 2 extends the same conditional permission, on a narrower necessity test, to providers and deployers of any other AI system or model and to deployers of high-risk AI systems, and states plainly that it creates no obligation to carry out bias detection or correction.
It applies from the Omnibus's entry into force on 27 July 2026: Article 113, third paragraph, point (a), as amended, applies Chapter I, which Article 4a joins, from 2 February 2025 with no exception for it, although recitals 9 and 40 of the Omnibus point to 2 August 2026.
When LexLint raises it
high_risk_decisionstrains_models
Read the law
official consolidated Official Journal text of Regulation (EU) 2026/1744, EUR-Lex
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.