{ "notice": "Illustrative mapping from the AI Governance Engineer Body of Knowledge v0.5.0 (not a claim of conformity)", "version": "0.5.0", "license": "CC BY 4.0", "licenseUrl": "https://creativecommons.org/licenses/by/4.0/", "schemaVersion": 1, "schema": "https://aigovernanceengineer.com/api/v1/schemas/control.json", "self": "https://aigovernanceengineer.com/api/v1/controls/aige-ctl-data-007.json", "source": "https://aigovernanceengineer.com/controls/data-admission-and-privacy#aige-ctl-data-007", "citation": { "title": "AI Governance Engineering: The Thesis & Body of Knowledge", "authors": [ "Jorge García Aibar" ], "parentDoi": "https://doi.org/10.5281/zenodo.22956197", "conceptDoi": "https://doi.org/10.5281/zenodo.22857084" }, "control": { "id": "AIGE-CTL-DATA-007", "profile": "data-admission-and-privacy", "url": "https://aigovernanceengineer.com/controls/data-admission-and-privacy#aige-ctl-data-007", "json": "https://aigovernanceengineer.com/api/v1/controls/aige-ctl-data-007.json", "title": "Special-Category Data Conditions", "version": "0.1", "status": "draft", "reviewerStatus": "open", "depth": "derived", "objective": "Special-category data in a dataset is recorded with the Art. 9(2) condition relied on, and when it is processed for bias detection and correction under Art. 4a it is used only where other data would not do, pseudonymised, access-controlled, not transmitted onwards and deleted once the bias is corrected or its retention period ends, whichever comes first, with the records of processing stating why it was strictly necessary.", "failureModes": [ "Special-category data is present in a dataset whose card says it is not, or with no condition recorded.", "Data admitted for bias detection is kept after the bias was corrected, used for another purpose or passed on.", "The records of processing do not say why special-category data was strictly necessary and why other data, including synthetic or anonymised data, would not do." ], "scope": "Datasets that contain special-category personal data, including data processed only to detect and correct bias. Sensitive data a model infers at runtime is covered by the proxy test and inference policy of chapter 19, not here.", "enforcementPoints": [ "deploy", "periodic" ], "verification": [ { "kind": "inspect", "text": "For each dataset processed under Art. 4a, the records of processing hold the strictly-necessary reason and a deletion log shows the data deleted once the bias was corrected or its retention period ended, whichever came first." } ], "evidence": [ { "artefact": "Special-category block on the dataset card: presence, condition relied on, and whether it is processed only for bias detection", "schemaId": "dataset-card", "schema": "https://aigovernanceengineer.com/schemas/dataset-card.v1.json", "layer": 2 }, { "artefact": "Records-of-processing entry with the Art. 4a reason", "schemaId": null, "schema": null, "layer": 2 }, { "artefact": "Deletion log of the pseudonymised bias set", "schemaId": null, "schema": null, "layer": 1 } ], "failureResponse": { "effect": "deny", "text": "A dataset with special-category data and no recorded condition is not admitted; an Art. 4a bias set without pseudonymisation or a deletion rule is not admitted for bias detection." }, "layer": 1, "secondaryLayers": [ 2 ], "patterns": [ { "slug": "dataset-admission-gate", "title": "Dataset Admission Gate", "url": "https://aigovernanceengineer.com/patterns/dataset-admission-gate" }, { "slug": "fairness-eval-suite", "title": "Fairness Eval Suite", "url": "https://aigovernanceengineer.com/patterns/fairness-eval-suite" } ], "seeds": [], "derivedFrom": [ { "kind": "schema", "ref": "dataset-card", "url": "https://aigovernanceengineer.com/resources/templates#schema-dataset-card" }, { "kind": "pattern", "ref": "dataset-admission-gate", "url": "https://aigovernanceengineer.com/patterns/dataset-admission-gate" }, { "kind": "chapter", "ref": "privacy-and-ai", "url": "https://aigovernanceengineer.com/bok/privacy-and-ai" } ], "mappings": { "obligations": [ { "id": "AIGE-OBL-GDPR-ART9", "name": "GDPR Art. 9 special categories, incl. inferred sensitive data", "url": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art9" }, { "id": "AIGE-OBL-EUAIA-ART4A", "name": "EU AI Act Art. 4a lawful basis for special-category data in bias detection", "url": "https://aigovernanceengineer.com/obligations/aige-obl-euaia-art4a" }, { "id": "AIGE-OBL-GDPR-ART30", "name": "GDPR Art. 30 records of processing activities", "url": "https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art30" } ], "iso42001": [], "nistAiRmf": [], "owasp": [], "atlas": [], "aiuc1": [], "csaAicm": [], "other": [] }, "references": [ { "n": 22, "title": "Privacy and data protection law applied to AI", "text": "Privacy and data protection law applied to AI (AI Governance Engineering Body of Knowledge v0.5.0, chapter 19, section \"Special categories, inferred data and biometrics\"). AI Governance Engineer (Jorge García Aibar). 2026-09.", "url": "https://aigovernanceengineer.com/bok/privacy-and-ai#special-categories-inferred-data-and-biometrics", "verified": "primary" }, { "n": 23, "title": "Privacy and data protection law applied to AI", "text": "Privacy and data protection law applied to AI (AI Governance Engineering Body of Knowledge v0.5.0, chapter 19, section \"Records of processing\"). AI Governance Engineer (Jorge García Aibar). 2026-09.", "url": "https://aigovernanceengineer.com/bok/privacy-and-ai#records-of-processing", "verified": "primary" }, { "n": 12, "title": "Governing AI development", "text": "Governing AI development (AI Governance Engineering Body of Knowledge v0.5.0, chapter 14, section \"The right to use the data\"). AI Governance Engineer (Jorge García Aibar). 2026-09.", "url": "https://aigovernanceengineer.com/bok/governing-development#the-right-to-use-the-data", "verified": "primary" }, { "n": 1, "title": "Dataset Admission Gate", "text": "Dataset Admission Gate (AI Governance Engineering Body of Knowledge v0.5.0, pattern catalogue (chapter 05): a job may read a dataset version only if a complete, signed admission record admits it for that use). AI Governance Engineer (Jorge García Aibar). 2026-09.", "url": "https://aigovernanceengineer.com/patterns/dataset-admission-gate", "verified": "primary" }, { "n": 24, "title": "Regulation (EU) 2024/1689 (AI Act), consolidated text of 2026-07-27, Arts. 4a and 10", "text": "Regulation (EU) 2024/1689 (AI Act), consolidated text of 2026-07-27, Arts. 4a and 10 (as amended by Reg. (EU) 2026/1744: Art. 10(5) deleted; Art. 4a inserted for special-category data in bias detection and correction). Publications Office of the EU (EUR-Lex). 2026-07-27.", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_4a", "verified": "primary" }, { "n": 18, "title": "Regulation (EU) 2016/679 (GDPR)", "text": "Regulation (EU) 2016/679 (GDPR) (Art. 5 principles, incl. 5(1)(b) purpose limitation and 5(1)(c) minimisation; Art. 6 lawful basis and 6(4) compatibility; Art. 7 consent; Art. 9 special categories; Arts. 15 to 17 and 21 rights; Art. 25 data protection by design and by default; Art. 30 records of processing; Arts. 35 and 36 DPIA and prior consultation). Publications Office of the EU (EUR-Lex). 2016-04-27.", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "verified": "primary" } ], "implementationNotes": [ "After the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026), the narrow basis to process special-category data for bias detection sits in Art. 4a; Art. 10(5) was deleted, so a card that still names Art. 10(5) points at a basis that no longer exists.", "Generate the records-of-processing entries from the registry, the data cards and the basis registry, so the Art. 4a reason does not go stale with the next pipeline change." ], "openQuestions": [ "What evidence shows that other data, including synthetic or anonymised data, would not have done for a given bias examination?" ], "observation": null, "observationSchema": "https://aigovernanceengineer.com/schemas/control-observation.v1.json", "examples": [] } }