Skip to main content
Praxikon
Back to the explorer
ObligationApplicablev1.0.0

Article 4a: legal basis for bias testing with special categories of personal data

Article 4a grants permission rather than instruction, and to two different sets of parties. Paragraph 1 allows only the provider of a high-risk AI system to process special categories of personal data by way of exception, to the extent strictly necessary for bias detection and correction within the meaning of Article 10(2), points (f) and (g), and only where all six conditions (a) to (f) are met. Paragraph 2 opens the same room to providers and deployers of other AI systems and models and to deployers of high-risk systems, but only for bias likely to affect the health and safety of persons, to have a negative impact on fundamental rights or to lead to discrimination prohibited under Union law, and subject to the same six conditions. Until 27 July 2026 this basis sat in Article 10(5).

The official source remains authoritative. This is general information about obligations and not legal advice. See this object on the map

Address and citation

This object has an address of its own that is never renamed or reused. Store the identifier in your own file, not the title or the link.

Identifier
praxikon:eu:ai-act:obligation:article-4a-bias-testing-legal-basis
Payload hash (sha256)
ffee7eb28c48cc8a2586f097f3abec38cbe7590c73e15b9845f9295f8f095d4c

Citation line

Praxikon, "Article 4a: legal basis for bias testing with special categories of personal data", praxikon:eu:ai-act:obligation:article-4a-bias-testing-legal-basis@1.0.0, dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0 (schema 1.5.0), effective_at 2026-08-08T00:00:00.000Z, known_at 2026-09-06T00:00:00.000Z, sha256 ffee7eb28c48cc8a2586f097f3abec38cbe7590c73e15b9845f9295f8f095d4c
Version
1.0.0
Legal time (effective_at)
27 July 2026
Knowledge time (known_at)
14 August 2026
Closed on
Not closed
Topics
fundamental-rights, high-risk-requirements

Review status: Placed against the official source (14 August 2026). Next check due by 10 February 2027. The check date is the knowledge date of this version; no later recheck has been recorded.

Who must act and who is affected

On an obligation the addressee is recorded separately from the party that is merely affected. That difference decides who a supervisory authority addresses and who has work to do without the duty resting on them.

Duty holder

Affected actor

Not recorded on this object.

Oversight

Not recorded on this object.

Evidence owner

What this object links to

Every relation appears below as a path: from the source with its locator, through the conditions and exceptions of the object carrying the relation, to the consequence. A locator belongs to a statement in the data and not to a relation, so the source is the source anchor of the carrying object.

Who carries the duty

3 of 3 shown

The duty rests on this role. A supervisory authority addresses this role when it is not met.

  1. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allParagraph 1 is open only to the provider of a high-risk AI system, and only to the extent that the processing is strictly necessary to detect and correct bias in accordance with Article 10(2), points (f) and (g). The deployer cannot rely on this paragraph, not even for a high-risk system; for the deployer the route runs through paragraph 2.
    • Condition | allParagraph 2 is open to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, but carries its own substantive threshold: the processing must be strictly necessary in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations. Bias without one of those consequences falls outside it.
    • Condition | allThe six conditions in paragraph 1 are cumulative and, through paragraph 2, point (b), apply to the wider circle as well: (a) other data, including synthetic or anonymised data, demonstrably do not suffice; (b) technical limitations on re-use apply plus state of the art security and privacy preserving measures, including pseudonymisation; (c) there is strict access control with documentation and confidentiality; (d) the data are not transmitted, transferred or otherwise accessed by other parties; (e) they are deleted once the bias has been corrected or the retention period ends, whichever comes first; (f) the record of processing activities states why the processing was strictly necessary and why the objective could not be achieved with other data.
    • ExceptionParagraph 2 closes by providing that it creates no obligation to carry out bias detection and correction. Article 4a is therefore a basis and not an instruction: without carrying out such processing there is nothing to comply with under this article, there is no date by which anything must be done, and outside the purpose of bias detection and correction it grants no room at all.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

Who owns the evidence

3 of 3 shown

This duty holder creates, maintains and can produce the evidence.

  1. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allParagraph 1 is open only to the provider of a high-risk AI system, and only to the extent that the processing is strictly necessary to detect and correct bias in accordance with Article 10(2), points (f) and (g). The deployer cannot rely on this paragraph, not even for a high-risk system; for the deployer the route runs through paragraph 2.
    • Condition | allParagraph 2 is open to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, but carries its own substantive threshold: the processing must be strictly necessary in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations. Bias without one of those consequences falls outside it.
    • Condition | allThe six conditions in paragraph 1 are cumulative and, through paragraph 2, point (b), apply to the wider circle as well: (a) other data, including synthetic or anonymised data, demonstrably do not suffice; (b) technical limitations on re-use apply plus state of the art security and privacy preserving measures, including pseudonymisation; (c) there is strict access control with documentation and confidentiality; (d) the data are not transmitted, transferred or otherwise accessed by other parties; (e) they are deleted once the bias has been corrected or the retention period ends, whichever comes first; (f) the record of processing activities states why the processing was strictly necessary and why the objective could not be achieved with other data.
    • ExceptionParagraph 2 closes by providing that it creates no obligation to carry out bias detection and correction. Article 4a is therefore a basis and not an instruction: without carrying out such processing there is nothing to comply with under this article, there is no date by which anything must be done, and outside the purpose of bias detection and correction it grants no room at all.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What has to be done

1 of 1 shown

This is what concretely has to be done under the obligation.

  1. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allParagraph 1 is open only to the provider of a high-risk AI system, and only to the extent that the processing is strictly necessary to detect and correct bias in accordance with Article 10(2), points (f) and (g). The deployer cannot rely on this paragraph, not even for a high-risk system; for the deployer the route runs through paragraph 2.
    • Condition | allParagraph 2 is open to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, but carries its own substantive threshold: the processing must be strictly necessary in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations. Bias without one of those consequences falls outside it.
    • Condition | allThe six conditions in paragraph 1 are cumulative and, through paragraph 2, point (b), apply to the wider circle as well: (a) other data, including synthetic or anonymised data, demonstrably do not suffice; (b) technical limitations on re-use apply plus state of the art security and privacy preserving measures, including pseudonymisation; (c) there is strict access control with documentation and confidentiality; (d) the data are not transmitted, transferred or otherwise accessed by other parties; (e) they are deleted once the bias has been corrected or the retention period ends, whichever comes first; (f) the record of processing activities states why the processing was strictly necessary and why the objective could not be achieved with other data.
    • ExceptionParagraph 2 closes by providing that it creates no obligation to carry out bias detection and correction. Article 4a is therefore a basis and not an instruction: without carrying out such processing there is nothing to comply with under this article, there is no date by which anything must be done, and outside the purpose of bias detection and correction it grants no room at all.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What has to be recorded

1 of 1 shown

This is what has to be in the file to show that the action was carried out.

  1. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allParagraph 1 is open only to the provider of a high-risk AI system, and only to the extent that the processing is strictly necessary to detect and correct bias in accordance with Article 10(2), points (f) and (g). The deployer cannot rely on this paragraph, not even for a high-risk system; for the deployer the route runs through paragraph 2.
    • Condition | allParagraph 2 is open to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, but carries its own substantive threshold: the processing must be strictly necessary in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations. Bias without one of those consequences falls outside it.
    • Condition | allThe six conditions in paragraph 1 are cumulative and, through paragraph 2, point (b), apply to the wider circle as well: (a) other data, including synthetic or anonymised data, demonstrably do not suffice; (b) technical limitations on re-use apply plus state of the art security and privacy preserving measures, including pseudonymisation; (c) there is strict access control with documentation and confidentiality; (d) the data are not transmitted, transferred or otherwise accessed by other parties; (e) they are deleted once the bias has been corrected or the retention period ends, whichever comes first; (f) the record of processing activities states why the processing was strictly necessary and why the objective could not be achieved with other data.
    • ExceptionParagraph 2 closes by providing that it creates no obligation to carry out bias detection and correction. Article 4a is therefore a basis and not an instruction: without carrying out such processing there is nothing to comply with under this article, there is no date by which anything must be done, and outside the purpose of bias detection and correction it grants no room at all.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What keeps it in place

1 of 1 shown

This is what keeps compliance in place over time, periodic or event-driven.

  1. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allParagraph 1 is open only to the provider of a high-risk AI system, and only to the extent that the processing is strictly necessary to detect and correct bias in accordance with Article 10(2), points (f) and (g). The deployer cannot rely on this paragraph, not even for a high-risk system; for the deployer the route runs through paragraph 2.
    • Condition | allParagraph 2 is open to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, but carries its own substantive threshold: the processing must be strictly necessary in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations. Bias without one of those consequences falls outside it.
    • Condition | allThe six conditions in paragraph 1 are cumulative and, through paragraph 2, point (b), apply to the wider circle as well: (a) other data, including synthetic or anonymised data, demonstrably do not suffice; (b) technical limitations on re-use apply plus state of the art security and privacy preserving measures, including pseudonymisation; (c) there is strict access control with documentation and confidentiality; (d) the data are not transmitted, transferred or otherwise accessed by other parties; (e) they are deleted once the bias has been corrected or the retention period ends, whichever comes first; (f) the record of processing activities states why the processing was strictly necessary and why the objective could not be achieved with other data.
    • ExceptionParagraph 2 closes by providing that it creates no obligation to carry out bias detection and correction. Article 4a is therefore a basis and not an instruction: without carrying out such processing there is nothing to comply with under this article, there is no date by which anything must be done, and outside the purpose of bias detection and correction it grants no room at all.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

Public tools

1 of 1 shown

This is the public route a reader can actually use.

  1. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allParagraph 1 is open only to the provider of a high-risk AI system, and only to the extent that the processing is strictly necessary to detect and correct bias in accordance with Article 10(2), points (f) and (g). The deployer cannot rely on this paragraph, not even for a high-risk system; for the deployer the route runs through paragraph 2.
    • Condition | allParagraph 2 is open to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, but carries its own substantive threshold: the processing must be strictly necessary in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations. Bias without one of those consequences falls outside it.
    • Condition | allThe six conditions in paragraph 1 are cumulative and, through paragraph 2, point (b), apply to the wider circle as well: (a) other data, including synthetic or anonymised data, demonstrably do not suffice; (b) technical limitations on re-use apply plus state of the art security and privacy preserving measures, including pseudonymisation; (c) there is strict access control with documentation and confidentiality; (d) the data are not transmitted, transferred or otherwise accessed by other parties; (e) they are deleted once the bias has been corrected or the retention period ends, whichever comes first; (f) the record of processing activities states why the processing was strictly necessary and why the objective could not be achieved with other data.
    • ExceptionParagraph 2 closes by providing that it creates no obligation to carry out bias detection and correction. Article 4a is therefore a basis and not an instruction: without carrying out such processing there is nothing to comply with under this article, there is no date by which anything must be done, and outside the purpose of bias detection and correction it grants no room at all.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

Changes recorded here

1 of 1 shown

This is a dated change in the rules that touches the object.

  1. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allParagraph 1 is open only to the provider of a high-risk AI system, and only to the extent that the processing is strictly necessary to detect and correct bias in accordance with Article 10(2), points (f) and (g). The deployer cannot rely on this paragraph, not even for a high-risk system; for the deployer the route runs through paragraph 2.
    • Condition | allParagraph 2 is open to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, but carries its own substantive threshold: the processing must be strictly necessary in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations. Bias without one of those consequences falls outside it.
    • Condition | allThe six conditions in paragraph 1 are cumulative and, through paragraph 2, point (b), apply to the wider circle as well: (a) other data, including synthetic or anonymised data, demonstrably do not suffice; (b) technical limitations on re-use apply plus state of the art security and privacy preserving measures, including pseudonymisation; (c) there is strict access control with documentation and confidentiality; (d) the data are not transmitted, transferred or otherwise accessed by other parties; (e) they are deleted once the bias has been corrected or the retention period ends, whichever comes first; (f) the record of processing activities states why the processing was strictly necessary and why the objective could not be achieved with other data.
    • ExceptionParagraph 2 closes by providing that it creates no obligation to carry out bias detection and correction. Article 4a is therefore a basis and not an instruction: without carrying out such processing there is nothing to comply with under this article, there is no date by which anything must be done, and outside the purpose of bias detection and correction it grants no room at all.

    As long as this exception is not ruled out, the outcome stays conditional and you have to establish it yourself.

    Consequence

What points at this object

Objects hanging off this obligation

5 of 5 shown

The object belongs to this obligation. The source line it hangs off sits there.

  1. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    • Condition | allRelevant only where you actually rely on Article 4a. In that case to be recorded before the processing starts, together with the data protection impact assessment, and to be revisited on every change to the purpose, the dataset or the set of people with access.

    Relation recorded on: Justify and record your reliance on Article 4a

    Consequence

  2. Source

    Official fact on this object, with its locator.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Article 4a inserted, Article 10(5) deleted

    Consequence

  3. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Access and deletion control for bias testing

    Consequence

  4. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Necessity file for bias testing

    Consequence

  5. Source

    This object carries no official fact of its own. The source line below sits on the obligation it hangs off; the link itself is recorded editorially.

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Article 1, point 2(b), replacing Article 2(7)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    • Digital Omnibus on AI 2026/1744

      Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)

      praxikon:eu:ai-act:source:reg-eu-2026-1744

      Open official source

    Via

    No condition or exception recorded on this object.

    Relation recorded on: Full text of Article 4a

    Consequence

What this object states

Official fact

Attributable to a named primary source, with a locator. Where they differ, the official source prevails.

  • Paragraph 1 provides that, to the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g), of this Regulation, providers of such systems may exceptionally process special categories of personal data, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons. In addition to the provisions set out in Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable, all the following conditions shall be met in order for such processing to occur: (a) the bias detection and correction cannot be effectively fulfilled by processing other data, including synthetic or anonymised data; (b) the special categories of personal data are subject to technical limitations on the re-use of personal data, and state-of-the-art security and privacy-preserving measures, including pseudonymisation; (c) the special categories of personal data are subject to measures to ensure that the personal data processed are secured and protected, subject to suitable safeguards, including strict controls and documentation of the access, to avoid misuse and to ensure that only authorised persons have access to those personal data with appropriate confidentiality obligations; (d) the special categories of personal data are not transmitted, transferred or otherwise accessed by other parties; (e) the special categories of personal data are deleted once the bias has been corrected or the personal data has reached the end of its retention period, whichever comes first; and (f) the records of processing activities pursuant to Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 include the reasons why the processing of special categories of personal data was strictly necessary to detect and correct biases, and why that objective could not be achieved by processing other data.

    • Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

  • Paragraph 2 provides that providers and deployers of other AI systems and models and deployers of high-risk AI systems may exceptionally process special categories of personal data to the extent that: (a) such processing is strictly necessary to ensure bias detection and correction in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited pursuant to Union law, especially where data outputs influence inputs for future operations; and (b) all of the conditions and safeguards set out in paragraph 1 are applied. Paragraph 2 closes with a separate subparagraph: this paragraph does not create any obligation to conduct such bias detection and correction. Article 4a has no paragraph 3.

    • Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

  • Regulation (EU) 2026/1744 inserts Article 4a into Regulation (EU) 2024/1689 by Article 1, point 6, and deletes Article 10(5) by Article 1, point 9(b). The same point 9 replaces Article 10(1) and Article 10(6) so that they now refer to the quality criteria in Article 4a(1). The basis therefore no longer sits with the requirements for high-risk systems in Chapter III, but as a standalone article in Chapter I, immediately after Article 4, while Article 10 refers back to it from the outside. In the Dutch language version of the Official Journal the inserted article is numbered "artikel 4 bis"; "Article 4a" is the English numbering of the same provision.

    • Locator: Article 1, point 6 (insertion) and point 9 (Article 10 amended, paragraph 5 deleted)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

  • The same amending Regulation replaces Article 2(7) of Regulation (EU) 2024/1689 by Article 1, point 2(b). Since 27 July 2026 that paragraph reads: "Union law on the protection of personal data, privacy and the confidentiality of communications applies to personal data processed in connection with the rights and obligations laid down in this Regulation. Without prejudice to Articles 4a and 59 of this Regulation, this Regulation shall not affect Regulation (EU) 2016/679 or (EU) 2018/1725, or Directive 2002/58/EC or (EU) 2016/680." The previous version of that paragraph carried no such reservation for Article 4a.

    • Locator: Article 1, point 2(b), replacing Article 2(7)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

  • Recital 9 of Regulation (EU) 2026/1744 states that bias detection and correction constitute a substantial public interest, that the extended legal basis is subject to the same limitations, conditions and safeguards as the existing Article 10(5), and that this thereby ensures compliance with Article 9(2), point (g), of Regulation (EU) 2016/679, Article 10(2), point (g), of Regulation (EU) 2018/1725 and Article 10, point (a), of Directive (EU) 2016/680. The same recital states that the legal basis established by Article 4a should apply from the date of entry into application of Regulation (EU) 2024/1689, so as to enable providers of high-risk AI systems lawfully to undertake bias detection and correction activities in preparation for compliance with the requirements for high-risk AI systems. Article 4 of the amending Regulation governs only entry into force on the third day following publication and provides for no deferred application; the amended Article 113, third paragraph, point (a), provides that Chapters I and II apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b), which apply from 2 December 2026. Article 4a sits in Chapter I and falls outside that exception.

    • Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

Our interpretation

Our own reading. It can change without the law changing, and it is not the position of a supervisory authority.

  • Three things matter more in practice than the relocation itself. The first is that this article instructs you to do nothing. Paragraph 2 says so in as many words, and no date by which anything must be done belongs with it either. The second, and the more dangerous misreading, is that the move into Chapter I means you may now start collecting sensitive attributes because you want to run fairness measurements. What has widened is the set of parties, not the room inside the basis: recital 9 expressly states that the same limitations, conditions and safeguards apply as under the former Article 10(5). In practice it therefore starts with a written justification of why synthetic or anonymised data do not suffice, and not with assembling a dataset. The third is the condition that bites hardest and appears in no summary: point (d) provides that the data are not transmitted, transferred or otherwise accessed by other parties. That is in effect a ban on outsourcing. An external fairness vendor, a bias auditing firm, a research partner or a cloud party that can reach the data itself does not fit inside this basis, however good the contract. Anyone who intended to buy in their bias testing must run it in house here, or work with data that are not a special category. Finally, watch your own documentation: records of processing, data protection impact assessments and AI policy documents that refer to Article 10(5) have been referring to a deleted provision since 27 July 2026. The same holds for documents citing Article 2(7) to argue that the GDPR prevails without qualification: that paragraph too has been replaced and now expressly reserves Articles 4a and 59. Two dates to close on, and the second is our inference rather than source text. Article 4a sits in Chapter I, which under Article 113, third paragraph, point (a), has applied since 2 February 2025, but the provision only entered the text on 27 July 2026; we therefore treat 27 July 2026 as the day the basis actually became available, while recital 9 states that it should apply from the date of entry into application of Regulation (EU) 2024/1689. Finally, note that the requirements in Article 10(2), points (f) and (g), which paragraph 1 refers to, themselves only start to apply on 2 December 2027 for Annex III systems and on 2 August 2028 for Annex I systems. The basis therefore deliberately runs ahead of the duty you use it for, exactly as recital 9 intends.

    • Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source
    • Locator: Article 1, point 2(b), replacing Article 2(7)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source
    • Locator: Recital 9, Article 4 (entry into force) and Article 1, point 40(a), replacing Article 113, third paragraph, point (a)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

Recommended step

A practical step we consider appropriate. Not an obligation following from the Regulation.

  • Carry out the data protection impact assessment before you start. Processing special categories at scale for bias testing engages Article 35 GDPR in almost every case, and Article 4a does not remove that assessment: it supplies the legal basis, not the risk appraisal. Then record, per processing operation, which paragraph of Article 4a you rely on, for which system or model, why synthetic or anonymised data do not suffice, which technical and organisational safeguards apply, who has access and at what point the data are deleted. In the same pass, review your record of processing activities, your impact assessments and your AI policy documents for references to Article 10(5) and replace them with Article 4a. Set the deletion moment as a monitored deadline rather than an intention, verify that no external party can reach the data, and align the justification with your data protection officer.

    • Locator: Article 1, point 6, inserting Article 4a: Article 4a(1), points (a) to (f), and Article 4a(2), points (a) and (b)praxikon:eu:ai-act:source:reg-eu-2026-1744Open official source

When this applies

  1. 1Paragraph 1 is open only to the provider of a high-risk AI system, and only to the extent that the processing is strictly necessary to detect and correct bias in accordance with Article 10(2), points (f) and (g). The deployer cannot rely on this paragraph, not even for a high-risk system; for the deployer the route runs through paragraph 2.
  2. 2Paragraph 2 is open to providers and deployers of other AI systems and models and to deployers of high-risk AI systems, but carries its own substantive threshold: the processing must be strictly necessary in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, especially where data outputs influence inputs for future operations. Bias without one of those consequences falls outside it.
  3. 3The six conditions in paragraph 1 are cumulative and, through paragraph 2, point (b), apply to the wider circle as well: (a) other data, including synthetic or anonymised data, demonstrably do not suffice; (b) technical limitations on re-use apply plus state of the art security and privacy preserving measures, including pseudonymisation; (c) there is strict access control with documentation and confidentiality; (d) the data are not transmitted, transferred or otherwise accessed by other parties; (e) they are deleted once the bias has been corrected or the retention period ends, whichever comes first; (f) the record of processing activities states why the processing was strictly necessary and why the objective could not be achieved with other data.

When this does not apply

  • Paragraph 2 closes by providing that it creates no obligation to carry out bias detection and correction. Article 4a is therefore a basis and not an instruction: without carrying out such processing there is nothing to comply with under this article, there is no date by which anything must be done, and outside the purpose of bias detection and correction it grants no room at all.

Referring to this object

Citation block

Copy this reference into your advice, article or file. The identifier, the version and the hash keep the statement findable later, even once the dataset has moved on.

Reference

Praxikon, "Article 4a: legal basis for bias testing with special categories of personal data",
praxikon:eu:ai-act:obligation:article-4a-bias-testing-legal-basis@1.0.0,
dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0 (schema 1.5.0),
effective_at 2026-07-27T00:00:00.000Z, known_at 2026-08-14T00:00:00.000Z,
sha256 ffee7eb28c48cc8a2586f097f3abec38cbe7590c73e15b9845f9295f8f095d4c,
https://www.praxikon.com/en/verkenner/obligation/article-4a-bias-testing-legal-basis
(https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-4a-bias-testing-legal-basis&effective_at=2026-07-27&known_at=2026-08-14&lang=en, accessed 2026-09-20)

Short form

praxikon:eu:ai-act:obligation:article-4a-bias-testing-legal-basis@1.0.0 (sha256 ffee7eb2)

BibTeX

@misc{praxikon-eu-ai-act-obligation-article-4a-bias-testing-legal-basis-1-0-0,
  author       = {{Praxikon}},
  title        = {Article 4a: legal basis for bias testing with special categories of personal data},
  year         = {2026},
  version      = {1.0.0},
  number       = {praxikon:eu:ai-act:obligation:article-4a-bias-testing-legal-basis},
  howpublished = {AI Act Change \& Evidence Graph, dataset 2.2.0, schema 1.5.0},
  note         = {effective_at 2026-07-27T00:00:00.000Z; known_at 2026-08-14T00:00:00.000Z; sha256 ffee7eb28c48cc8a2586f097f3abec38cbe7590c73e15b9845f9295f8f095d4c},
  url          = {https://www.praxikon.com/en/verkenner/obligation/article-4a-bias-testing-legal-basis},
  urldate      = {2026-09-20},
  language     = {en}
}

CSL JSON

[
  {
    "id": "praxikon:eu:ai-act:obligation:article-4a-bias-testing-legal-basis@1.0.0",
    "type": "dataset",
    "title": "Article 4a: legal basis for bias testing with special categories of personal data",
    "container-title": "AI Act Change & Evidence Graph",
    "publisher": "Praxikon",
    "version": "1.0.0",
    "number": "praxikon:eu:ai-act:obligation:article-4a-bias-testing-legal-basis",
    "URL": "https://www.praxikon.com/en/verkenner/obligation/article-4a-bias-testing-legal-basis",
    "language": "en",
    "issued": {
      "date-parts": [
        [
          2026,
          8,
          14
        ]
      ]
    },
    "accessed": {
      "date-parts": [
        [
          2026,
          9,
          20
        ]
      ]
    },
    "note": "dataset praxikon:sys:registry:dataset:ai-act-implementation-graph 2.2.0; schema 1.5.0; effective_at 2026-07-27T00:00:00.000Z; known_at 2026-08-14T00:00:00.000Z; sha256 ffee7eb28c48cc8a2586f097f3abec38cbe7590c73e15b9845f9295f8f095d4c; retrieved_from https://www.praxikon.com/api/v1/obligations?id=praxikon%3Aeu%3Aai-act%3Aobligation%3Aarticle-4a-bias-testing-legal-basis&effective_at=2026-07-27&known_at=2026-08-14&lang=en; licence https://www.praxikon.com/nl/legal/terms"
  }
]

How to verify a reference later is set out in the methodology. Terms

For agents and integrations

This page and the machine output come from the same object and the same two time axes.

Open as JSONOpen as JSON-LDHuman explanationRead the methodology