Skip to content

Regulation Tracker / EU AI Act / Chapter I

Article 4a
Processing of special categories of personal data for bias detection and correction

Chapter I — Subject matter'. 10 distinct duties, powers or definitions are coded from this article, applying from 2025-02-02. 10 reach legal practice directly.

Inserted by Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 2026-07-27. The text below is the consolidated version of 27 July 2026; the amending regulation are on EUR-Lex.

official text: EUR-Lex (consolidated 27 Jul 2026) · text © European Union (Decision 2011/833/EU) · coding CC BY 4.0 · data: obligations.json · Hugging Face · GitHub

The text

1. To the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g), of this Regulation, providers of such systems may exceptionally process special categories of personal data, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons. In addition to the provisions set out in Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable, all the following conditions shall be met in order for such processing to occur:

  1. (a)the bias detection and correction cannot be effectively fulfilled by processing other data, including synthetic or anonymised data;
  2. (b)the special categories of personal data are subject to technical limitations on the re-use of personal data, and state-of-the-art security and privacy-preserving measures, including pseudonymisation;
  3. (c)the special categories of personal data are subject to measures to ensure that the personal data processed are secured and protected, subject to suitable safeguards, including strict controls and documentation of the access, to avoid misuse and to ensure that only authorised persons have access to those personal data with appropriate confidentiality obligations;
  4. (d)the special categories of personal data are not transmitted, transferred or otherwise accessed by other parties;
  5. (e)the special categories of personal data are deleted once the bias has been corrected or the personal data has reached the end of its retention period, whichever comes first; and
  6. (f)the records of processing activities pursuant to Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 include the reasons why the processing of special categories of personal data was strictly necessary to detect and correct biases, and why that objective could not be achieved by processing other data.

2. Providers and deployers of other AI systems and models and deployers of high-risk AI systems may exceptionally process special categories of personal data to the extent that:

  1. (a)such processing is strictly necessary to ensure bias detection and correction in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited pursuant to Union law, especially where data outputs influence inputs for future operations; and
  2. (b)all of the conditions and safeguards set out in paragraph 1 are applied.

What it requires, coded

SafeLegalAI's reading of each duty in this article: who, what, from when, under which fine tier, and whether it reaches a firm, chambers, court or legal-AI vendor. Descriptive, not advice; the quoted words are the Regulation's.

  1. Art. 4a(1)Derogation or exemptionHigh-risklegal practice

    High-risk AI providers may exceptionally process special categories of personal data only to the extent strictly necessary for bias detection and correction and subject to safeguards and the listed conditions.

    "To the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g), of this Regulation, providers of such systems may exceptionally process special categories of personal data, subject to appropriate safeguards for the fundamental rights and freedoms of natural persons. In addition to the provisions set"
    Who
    Provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Legal-AI vendors providing high-risk judicial or public-sector systems may rely on this narrow processing permission for bias work.
    See
    Art. 10(2)(f) · Art. 10(2)(g) · Regulation (EU) 2016/679 · Regulation (EU) 2018/1725 · Directive (EU) 2016/680

  2. Art. 4a(1) (a)Data governanceHigh-risklegal practice

    Special-category processing for high-risk bias detection and correction is conditioned on the objective not being effectively fulfilled by other data, including synthetic or anonymised data.

    "the bias detection and correction cannot be effectively fulfilled by processing other data, including synthetic or anonymised data;"
    Who
    Provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Important for legal-AI providers handling sensitive client, litigant, employee or court-user data during bias testing.
    See
    Art. 10(2)(f) · Art. 10(2)(g)

  3. Art. 4a(1) (b)Data governanceHigh-risklegal practice

    Special-category data must be subject to technical limits on reuse and state-of-the-art security and privacy-preserving measures, including pseudonymisation.

    "the special categories of personal data are subject to technical limitations on the re-use of personal data, and state-of-the-art security and privacy-preserving measures, including pseudonymisation;"
    Who
    Provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Legal-AI providers processing sensitive attributes for bias work must account for reuse limits, security and privacy-preserving techniques.
    See
    Art. 10(2)(f) · Art. 10(2)(g)

  4. Art. 4a(1) (c)Data governanceHigh-risklegal practice

    Special-category data must be secured with suitable safeguards, strict access controls and access documentation so only authorised persons with confidentiality obligations can access it.

    "the special categories of personal data are subject to measures to ensure that the personal data processed are secured and protected, subject to suitable safeguards, including strict controls and documentation of the access, to avoid misuse and to ensure that only authorised persons have access to those personal data with appropriate confidentiality obligations;"
    Who
    Provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Highly relevant where legal-AI providers use sensitive case, client, staff or litigant data to detect or correct bias.
    See
    Art. 10(2)(f) · Art. 10(2)(g)

  5. Art. 4a(1) (d)Data governanceHigh-risklegal practice

    Special-category personal data processed under Article 4a(1) must not be transmitted, transferred or otherwise accessed by other parties.

    "the special categories of personal data are not transmitted, transferred or otherwise accessed by other parties;"
    Who
    Provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Important for legal-AI vendors because sensitive legal datasets may not be shared onward under this bias-processing route.
    See
    Art. 10(2)(f) · Art. 10(2)(g)

  6. Art. 4a(1) (e)Data governanceHigh-risklegal practice

    Special-category personal data must be deleted once the bias is corrected or the data reaches the end of its retention period, whichever occurs first.

    "the special categories of personal data are deleted once the bias has been corrected or the personal data has reached the end of its retention period, whichever comes first; and"
    Who
    Provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Relevant to legal-AI vendors’ retention of sensitive bias-testing data derived from clients, workers, litigants or public users.
    See
    Art. 10(2)(f) · Art. 10(2)(g)

  7. Art. 4a(1) (f)DocumentationHigh-risklegal practice

    Records of processing activities must state why special-category processing was strictly necessary for bias detection and correction and why other data could not achieve the objective.

    "the records of processing activities pursuant to Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 include the reasons why the processing of special categories of personal data was strictly necessary to detect and correct biases, and why that objective could not be achieved by processing other data."
    Who
    Provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Legal-AI providers need records explaining the necessity of sensitive-data processing when relying on Article 4a for bias work.
    See
    Regulation (EU) 2016/679 · Regulation (EU) 2018/1725 · Directive (EU) 2016/680

  8. Art. 4a(2)Derogation or exemptionAll AI systemslegal practice

    Providers and deployers of other AI systems and models, and deployers of high-risk AI systems, may exceptionally process special categories of personal data only within the Article 4a(2) limits.

    "Providers and deployers of other AI systems and models and deployers of high-risk AI systems may exceptionally process special categories of personal data to the extent that:"
    Who
    Provider, Deployer, GPAI model provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — This can reach law firms, courts and legal-AI vendors that process sensitive data to detect or correct bias in non-high-risk or model contexts.
    See
    Art. 4a(1)

  9. Art. 4a(2) (a)Data governanceAll AI systemslegal practice

    For other AI systems and models and high-risk deployers, special-category processing must be strictly necessary for bias detection and correction involving likely health, safety, fundamental-rights or discrimination impacts.

    "such processing is strictly necessary to ensure bias detection and correction in view of possible biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited pursuant to Union law, especially where data outputs influence inputs for future operations; and"
    Who
    Provider, Deployer, GPAI model provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Relevant to legal practices and vendors testing AI outputs that may feed future operations and create discrimination or rights risks.
    See
    Art. 4a(1)

  10. Art. 4a(2) (b)Data governanceAll AI systemslegal practice

    The exceptional processing route for other AI systems and models, and for deployers of high-risk systems, requires all Article 4a(1) conditions and safeguards to be applied.

    "all of the conditions and safeguards set out in paragraph 1 are applied."
    Who
    Provider, Deployer, GPAI model provider
    From
    (Art. 113(a) as amended by Reg. (EU) 2026/1744)Inserted by Regulation (EU) 2026/1744, in force 2026-07-27.
    Legal practice
    Reaches legal practice directly — Legal deployers and vendors using sensitive data for bias work must import the paragraph 1 safeguards into this broader processing route.
    See
    Art. 4a(1)

Cite

Regulation (EU) 2024/1689, Article 4a (Processing of special categories of personal data for bias detection and correction), as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026, https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng#art_4a — text © European Union; only the Official Journal is authentic. Coding: SafeLegalAI (published by Cognesio LLP), "EU AI Act, structured", safelegalai.com/regulation/eu-ai-act/article-4a, accessed 2026-09-08, CC BY 4.0.