Home › EU AI Act Article 10
EU AI Act Article 10, and what it means for your speech data
The high-risk deadline moved. The data governance requirement did not change, and datasets take years to build. Here is what Article 10 actually asks of training data, and what a speech data vendor has to hand you for you to answer it.
Where the law currently stands
Regulation (EU) 2026/1744, the Digital Omnibus, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 - six days before the original high-risk deadline. It deferred the application of the high-risk obligations:
- Stand-alone Annex III high-risk systems: now apply from 2 December 2027.
- AI embedded in regulated products under Annex I: now apply from 2 August 2028.
- Article 50 transparency obligations: took effect 2 August 2026 as scheduled, and are live now. These include disclosure and marking of synthetic content, which covers synthetic audio.
- General-purpose AI model obligations: in force since 2 August 2025.
- Article 5 prohibitions: enforceable since February 2025.
The deferral is a change of date, not a change of substance. A dataset commissioned today will still be inside a system that has to answer Article 10 when it applies - and speech data cannot be retrofitted with consent it never collected.
Article 10 in practice
What the data governance requirement actually asks
Article 10 requires training, validation and testing data to be developed under data governance practices appropriate to the purpose. Reduced to what it means for a speech dataset:
Collection process and origin
You have to be able to describe where the data came from and how it was gathered. For speech that means named recruitment routes, per-contributor consent records, and a provenance trail rather than “sourced from a platform”.
Relevance and representativeness
Data has to be relevant and sufficiently representative for the intended purpose, taking account of the geographical, contextual, behavioural and functional setting. In speech, that is accent, dialect, age, and speaking conditions matched to actual deployment.
Examination for bias
Datasets must be examined for biases likely to affect health, safety or fundamental rights, or to cause discrimination - with measures to detect, prevent and mitigate them. Speech recognition failing on particular accents is precisely the shape of problem this is aimed at.
Gaps and shortcomings
Identifying what is missing is an explicit requirement, not a confession. A vendor who tells you which cohorts are thin is doing the work; one who claims complete coverage is not.
Data preparation
Annotation, labelling, cleaning, enrichment and aggregation all have to be documented as design decisions - including transcription conventions and what was discarded at QC and why.
Lawful basis alongside GDPR
The AI Act sits on top of data protection law, it does not replace it. Voice recordings are personal data, and a voice used to identify a speaker is biometric data. Consent, retention and deletion still have to stand up under GDPR independently.
What we hand over with a dataset
Article 10 obligations fall on the provider of the high-risk system, not on us. But you cannot evidence collection process, origin, representativeness or gaps using data somebody else gathered and will not describe. So the documentation travels with the audio:
- Per-contributor written consent naming your organisation, the purpose, the territory and the licence term.
- Recruitment methodology - how speakers for each cohort were found and screened.
- Demographic and linguistic composition of the delivered set, per language rather than averaged.
- Known gaps and thin cohorts, stated plainly.
- Recording conditions and technical spec, consistent and documented.
- Annotation conventions and QC criteria, including rejection reasons.
- Retention and deletion routes, in writing.
Why this is not a compliance flourish
Speech data has a long lead time. Recruiting rare accents, running sessions and QCing a corpus is measured in months, and the resulting dataset then sits inside a model for years. Data collected now without consent records will still be undocumented in December 2027. The deferral bought scheduling room, not a reason to collect carelessly.
It also cuts the other way commercially. If Article 50 already requires synthetic audio to be marked and disclosed, the provenance of the voice behind it stops being an internal detail. See consent-cleared voice cloning for how we handle voice identity specifically.
Current as of 1 September 2026. This is how we design collection work, not legal advice - take your own advice on your system’s classification and obligations.
Article 10, asked plainly
Did the high-risk AI Act deadlines move?
Yes. Regulation (EU) 2026/1744 - the Digital Omnibus - was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Stand-alone Annex III high-risk systems now apply from 2 December 2027, and AI embedded in regulated products under Annex I from 2 August 2028. The substance of Article 10 was not rewritten; the date moved.
What applies right now?
Article 50 transparency obligations took effect on 2 August 2026 as originally scheduled, including disclosure and marking of synthetic content - which covers synthetic audio. General-purpose AI model obligations have applied since 2 August 2025, and the Article 5 prohibitions since February 2025.
Does Article 10 apply to a voice dataset we buy in?
Article 10 places obligations on the provider of the high-risk AI system, not the data vendor. But the provider can only meet them with information about how the data was collected, from whom, with what consent and with what gaps - which has to come from the vendor. A dataset delivered without that trail transfers the problem to you.
Is this legal advice?
No. It is how we design collection work, written by a production company, current as of 1 September 2026. Take your own advice on your specific system and its classification.
Commission data you can still defend in 2027
Consent, provenance and coverage documented at collection, because none of it can be added afterwards.