European UnionAI Act, Article 4a (processing of special categories of personal data for bias detection and correction)
Regulation (EU) 2024/1689, Article 4a
In force since .
An AI governance rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Market targeting, Operator establishment, Place of effect
- Obligation class
- Governance, Security
- Audit expectation
- none
What it requires
- If you are a provider of a high-risk AI system, you may exceptionally process special categories of personal data to the extent strictly necessary to detect and correct bias under Article 10(2), points (f) and (g), provided all six conditions of Article 4a(1) are met: the bias cannot be effectively addressed with other data, including synthetic or anonymised data; the data is subject to technical re-use limits and state-of-the-art security, including pseudonymisation; the data is secured with strict access controls and documented access; the data is not transmitted, transferred, or otherwise accessed by other parties; the data is deleted once the bias is corrected or its own retention period ends, whichever comes first; and your records of processing activities under the General Data Protection Regulation (GDPR), the EU institutions data protection regulation, or the law enforcement directive state why the processing was strictly necessary and why other data could not achieve the same result.
- If you are a provider or deployer of any other AI system or model, or a deployer of a high-risk AI system, you may exceptionally process special categories of personal data under the same conditions, but only to the extent strictly necessary to detect and correct bias likely to affect health and safety, have a negative impact on fundamental rights, or lead to discrimination prohibited under Union law. This paragraph creates no obligation to conduct such bias detection and correction.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
Operative text: Article 113, third paragraph, point (a), as amended, applies Chapters I and II from and carves out only Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b). Article 4a sits in Chapter I, so it applies once it exists, on . Recital 9 says the Article 4a legal basis should apply from the AI Act's date of entry into application, which recital 40 gives as . The row follows the operative text.
- As of
- Open questions
- Does Article 4a apply from the Omnibus's entry into force on , as Article 113, third paragraph, point (a), as amended, reads (it applies Chapter I from and names no exception for Article 4a), or from , the general application date that recitals 9 and 40 of Regulation (EU) 2026/1744 point to?
What it makes you log
What the log must hold
Decision basis
Log retention
Paragraph 1, point (e): the special categories of personal data processed under this Article must be deleted once the bias has been corrected or the data's own retention period ends, whichever comes first. No fixed number of days, months, or years is stated.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- the special categories of personal data processed under this Article, once the bias has been corrected or the data's own separately-applicable retention period ends, whichever comes first
Logging duty
Paragraph 1, point (f), requires that the GDPR, EU institutions data protection regulation, or law enforcement directive records of processing activities include the reasons the processing of special categories of personal data was strictly necessary to detect and correct bias, and why that objective could not be achieved with other data. Paragraph 2, point (b), applies all the conditions and safeguards of paragraph 1, including point (f), to the providers and deployers it covers, so paragraph 2 repeats no recordkeeping point of its own.
- Kind
- Explicit
- As of
- Provision
- Article 4a(1), point (f)
- Trigger
- personal_data_processing
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32024r1689
What this law does
Article 4a, inserted into the AI Act by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since ), is a conditional permission rather than a duty: it lets a provider of a high-risk AI system exceptionally process special categories of personal data where strictly necessary for the bias detection and correction the Article 10(2), points (f) and (g), data-governance duty requires, if all six conditions of paragraph 1 are met (no adequate substitute data, technical re-use limits and state-of-the-art security including pseudonymisation, strict access controls and documented access, no transmission to other parties, deletion once the bias is corrected or the data's own retention period ends, and a documented reason in the General Data Protection Regulation (GDPR) records of processing activities).
Paragraph 2 extends the same conditional permission, on a narrower necessity test, to providers and deployers of any other AI system or model and to deployers of high-risk AI systems, and states plainly that it creates no obligation to carry out bias detection or correction.
It applies from the Omnibus's entry into force on : Article 113, third paragraph, point (a), as amended, applies Chapter I, which Article 4a joins, from with no exception for it, although recitals 9 and 40 of the Omnibus point to .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or trains models.
Back to the example · Lint your app
Page updated .