2026-08-10 - Article 4a of the AI Act: A Legal Basis That Precedes the Obligation It Serves

Read on website

---

Among the amendments introduced by Regulation (EU) 2026/1744, one directly affects the daily work of data protection practitioners and has attracted little discussion because it lacks the visibility of prohibitions and deadlines.

Article 1, point 6, of the Regulation inserts an Article 4a into the AI Act; point 9 deletes Article 10(5). This is not a neutral relocation, nor even the transfer of a rule already in operation: as we shall see, Article 10(5) had never become applicable. The legal basis for processing special categories of personal data for bias detection and correction is lifted out of the article on training data for high-risk systems, placed in Chapter I, and widened as regards who may rely on it.

In this contribution, we isolate three consequences that, in our view, warrant operational attention: the relationship with Article 9 GDPR, its application before the underlying obligation becomes enforceable, and the role the record of processing activities takes on as a condition of lawfulness.

What the new Article 4a says

Paragraph 1 carries over, for providers of high-risk AI systems, the text of the former Article 10(5). To the extent strictly necessary to ensure bias detection and correction in accordance with Article 10(2), points (f) and (g), such providers may exceptionally process special categories of personal data, provided all six of the following conditions are met:

Paragraph 2 is the substantive novelty. It extends the possibility to providers and deployers of other AI systems and models, and to deployers of high-risk AI systems, under the same conditions as paragraph 1 and with an additional requirement: that the processing be strictly necessary in view of possible biases likely to affect the health and safety of persons, to hurt fundamental rights or to lead to discrimination prohibited under Union law, ’especially where data outputs influence inputs for future operations'.

That closing phrase deserves a note: it is an explicit reference to feedback loops, that is, to situations in which the system’s output feeds the data on which the system will later operate. It is the mechanism by which an initial bias entrenches itself rather than dissipating.

Paragraph 2 closes with a clarification that must be read carefully:

‘This paragraph does not create any obligation to conduct such bias detection and correction.’

Recital 9 clarifies the provision’s function. The legal basis is subject to the same limitations, conditions and safeguards as the former Article 10(5), ’thereby ensuring compliance’ with Article 9(2), point (g) GDPR, Article 10(2), point (g) of Regulation (EU) 2018/1725 and Article 10, point (a) of Directive (EU) 2016/680.

Article 4a is therefore to be read as the provision of Union law satisfying the substantial public interest condition required by Article 9(2), point (g) — not as an autonomous and self-sufficient legal basis.

The enacting terms confirm this. Paragraph 1 specifies that the six conditions apply in addition to, not instead of, ’the provisions set out in Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable'.

The practical consequence should be stated plainly to controllers: Article 4a satisfies, on the conditions it lays down, the requirement of Article 9(2), point (g) GDPR, and thereby makes it possible to process special categories that would otherwise be prohibited; it does not supply the lawfulness condition under Article 6. Anyone relying on it must still identify and document that condition.

One shortcut should be avoided here. Article 6(1)(c) cannot rest on the not-yet-enforceable obligation in Article 10(2), points (f) and (g), alone: as long as that obligation is not enforceable, it cannot constitute the present legal obligation to which point (c) refers. Unless the controller identifies a different obligation that is already applicable, the condition will have to be found in point (e) or point (f), depending on the nature of the entity and the context, with the assessment each of them requires.

For systematic coherence, note also the amendment to Article 2(7) of the AI Act made by point 2(b): the relationship with the GDPR, Regulation (EU) 2018/1725 and Directives 2002/58/EC and (EU) 2016/680 remains unaffected ‘without prejudice to Articles 4a and 59’. Article 4a is thus expressly framed as an exception to the non-interference clause.

Here lies the most unusual feature of the construction.

Article 4a(1) anchors strict necessity to bias detection and correction ‘in accordance with Article 10(2), points (f) and (g)’. But Article 10 sits in Section 2 of Chapter III, and Sections 1, 2 and 3 of Chapter III have been postponed to 2 December 2027 or 2 August 2028 depending on the system’s classification. Article 4a, sitting in Chapter I, operates instead from the entry into force of the amending Regulation.

The legal basis, in other words, becomes available before the obligation it is meant to serve becomes enforceable.

The choice is deliberate. Recital 9 justifies it by the need to allow providers of high-risk AI systems to lawfully undertake bias detection and correction activities ‘in preparation for compliance’ with requirements that will apply later. It is a sensible choice: without it, preparing for compliance would have been unlawful until the day compliance fell due.

A drafting imprecision should nonetheless be flagged. Recital 9 states that the legal basis ‘should apply from the date of entry into application of that Regulation’, referring to Regulation (EU) 2024/1689, whose general date of application is 2 August 2026. The enacting terms lead to a different result: Article 4a is inserted into Chapter I, applicable from 2 February 2025, and therefore operates from the entry into force of the amending Regulation on 27 July 2026. In our view, the enacting terms prevail, and that is the date; in any event, the gap between the two readings is six days and produces no practical effect.

What does follow is a significant practical effect on the strict necessity assessment. A controller invoking Article 4a(1) today must justify the necessity of the processing by reference to an obligation that is not yet enforceable. The reasoning will therefore have to account for the compliance plan, the adaptation timetable, and the reason why the activity cannot be deferred until the obligation arises. This is not a formality: it is central to demonstrating that the processing is justified.

What is excluded, in our view, is that Article 4a could legitimize processing already carried out before it entered into force. Retroactive effect would require an express transitional provision, and there is none.

One easily made error should nonetheless be avoided, and it concerns the deleted provision. Earlier processing operations are not to be assessed under the former Article 10(5). That provision sat in Section 2 of Chapter III and, under the original text of the AI Act, was not yet applicable: it was deleted on 27 July 2026, before it ever produced effects. Processing carried out up to that date must therefore be assessed solely against the conditions of the GDPR, or of the other applicable instruments, without any AI Act legal basis being available.

This is, on reflection, precisely why the early application of Article 4a was necessary: until 27 July 2026 the AI Act had never offered a basis for processing special categories for bias detection purposes.

Third consequence: the record as a condition of lawfulness

The condition in point (f) of paragraph 1 is operationally the most demanding. The records of processing activities must contain two distinct sets of reasons: why the processing of special categories was strictly necessary, and why the objective could not be achieved by processing other data.

This is an unusual provision. A rule of the AI Act prescribes the content of the record referred to in Article 30 GDPR, and makes it one of six cumulative conditions for the lawfulness of the processing.

The consequence is that an absent, generic or incomplete record is not merely a breach of Article 30 GDPR. It leaves the processing without one of the conditions on which Article 4a makes the derogation depend, which means that the processing no longer qualifies for the Article 9(2)(g) exception.

A clarification on how to comply. The text requires that the records ‘include’ those reasons. A precise cross-reference to controlled and accessible documentation is arguable, and in complex organizations may be the only workable solution; but it is a position not yet tested by practice or guidance. In our view, direct inclusion in the record remains the safe reading, and anyone opting for cross-reference should do so knowingly.

One doubt that may arise for smaller organizations is worth resolving. The derogation in Article 30(5) GDPR does not help: it does not apply where the processing involves special categories of data. Anyone intending to rely on Article 4a must therefore maintain the record, irrespective of headcount.

On the documentary side, the section of the record dedicated to Article 4a processing should in our view contain, in addition to the ordinary Article 30 elements: a description of the hypothesised bias and of the group potentially affected; the documented outcome of the alternatives test, including synthetic and anonymised data, with the technical reason for their insufficiency; the pseudonymisation and re-use limitation measures adopted; the access log; and the deletion criterion and deadline, anchored to the event ‘bias corrected’ as well as to the retention period.

Coordination between DPIA and FRIA

Article 1, point 13, amends Article 27 of the AI Act in paragraphs 4 and 5. A deployer conducting the fundamental rights impact assessment may include cross-references to the relevant sections of the data protection impact assessment carried out under Article 35 GDPR or Article 27 of Directive (EU) 2016/680, or incorporate relevant parts of it. The AI Office is to develop a template questionnaire, including through an automated tool, giving practical effect to those cross-references.

This is the direct development of the

coordination question between the two assessments

. But the date of application should be flagged: Article 27 sits in Section 3 of Chapter III and therefore follows the postponement, while Article 4a operates immediately.

Anyone setting up Article 4a processing today must therefore document its necessity and safeguards without the benefit of either the express cross-referencing facility or the AI Office template. In our view, the coordination should be built now in any case, as good practice: the data protection impact assessment accompanying the processing of special categories for bias detection will be the foundation on which the fundamental rights impact assessment rests once it becomes enforceable.

A possibility, not an obligation

Finally, the point made explicit by the closing sentence of paragraph 2 should be kept firmly in view: the provision creates no obligation to conduct bias detection and correction.

It follows that widening the personal scope does not introduce a duty of bias testing for deployers or for providers of systems other than high-risk ones. What it introduces, for a broad range of operators, is the possibility of processing special categories of personal data for that purpose.

In our view this is the point at which characterizing the intervention as simplification is least apt. The Regulation does not lighten a burden: it creates a new derogation from the prohibition in Article 9(1) GDPR and makes it available to actors who did not previously have it. That the derogation is surrounded by six cumulative conditions and by the strict necessity test is why the choice is defensible; but it remains a widening, not a narrowing, of the range of processing operations abstractly permitted.

On this point, recital 47 records that the European Data Protection Supervisor and the European Data Protection Board were consulted and delivered their joint opinion on 20 January 2026.

What to do now

Controllers intending to rely on Article 4a. Prepare the documentation of the six conditions before processing begins. The strict necessity reasoning belongs in the record, not in a separate document.

DPOs. Check that Article 4a is not being presented internally as a self-standing legal basis. An Article 6 lawfulness condition is still required and, for processing likely to result in a high risk within the meaning of Article 35 GDPR, a data protection impact assessment.

Deployers of high-risk AI systems. The possibility is new and was not available under the former Article 10(5). Those who exercise it assume in their own right the burden of the six conditions, which previously fell on the provider alone.

Those preparing for the 2027-2028 deadlines. Document the link between the processing and the compliance plan. Strict necessity, today, is measured against a future obligation.

Reference documents

http://data.europa.eu/eli/reg/2026/1744/oj

http://data.europa.eu/eli/reg/2024/1689/oj

http://data.europa.eu/eli/reg/2016/679/oj

http://data.europa.eu/eli/reg/2018/1725/oj

http://data.europa.eu/eli/dir/2016/680/oj

---

This contribution is for information purposes only and does not constitute legal advice. Verbatim quotations are taken from the English version published in the Official Journal of 24 July 2026.

---

New to Gemini? This capsule is best read with a Gemini client, such as Lagrange.

Lagrange - a Gemini client for desktop, iOS and Android

Back to articles list

English section

Home

Proxied content from gemini://nicfab.eu/en/gemlogen/2026/2026-08-10-article-4a-bias-detection_en.gmi

Gemini request details:

Original URL
gemini://nicfab.eu/en/gemlogen/2026/2026-08-10-article-4a-bias-detection_en.gmi
Status code
Success
Meta
text/gemini;lang=en-US
Proxied by
kineto

Be advised that no attempt was made to verify the remote SSL certificate.