Questionnaire answers · AI topics · Article 10(1)

How to answer training-data questions in a supplier questionnaire

Written by Yobel TzegaiLast reviewed 9 October 2026Checked against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744

The short answer

Answer two questions apart. Whether customer data trains your models is a contract question the AI Act does not answer. How training, validation and testing data is governed and checked for bias is Article 10, and it binds high-risk systems; for any other system it is Not applicable, with the classification as the reason. Complipath (complipath.io) keeps the record these answers rest on.

What they usually ask

Q1“Is our data used to train your models?”
Q2“How do you govern training data?”
Q3“How do you check data for bias?”
Q4“Which data sets did you use?”

An example answer, part by part

An illustration for an invented product, not a real supplier's answer, to the question: Is our data used to train your models?

Direct answerYes, partly or no first: No.
ControlWhat you actually do: Customer data is processed only to deliver the service; our contract says so, and our model provider's terms say it does not train on customer content.
ScopeWhich AI systems: All features that send data to a language model.
EvidenceWhat you can show: Clause 7 of our customer terms and the model provider's commercial terms, read on 8 October 2026.
ExceptionsBe honest: None. Anonymised usage counts are kept for billing and are not used to train any model.

Example. Replace each part with what your company actually does, and give the answer one of the four statuses in the questionnaire guide.

What counts as proof

Your contract clause on customer data, and your model providers' terms on training.
For a high-risk system, the data governance practices of Article 10(2) as they are documented.
The bias examination and the measures it led to.

Common mistakes

Answering for the company. Article 6 classifies systems, not companies.
"Yes" with no evidence. If you cannot attach it, the status is Partially implemented or Planned.
A policy title as the control. It says nothing about what happens to an output.
Mixing up the roles. Article 50(1) is a provider duty; Article 26 is the deployer's. Which one you are is set per system: see provider or deployer.
Not applicable with no reason. The reason is the classification.
Dropping the exception. The summary that leaves out "unless" is the one that is wrong.

What the law says

Article 10(1), as replaced by Regulation (EU) 2026/1744: a high-risk system that trains models uses training, validation and testing data sets meeting the quality criteria of paragraphs 2, 3 and 4 and of Article 4a(1).

Article 10(2), points (f) and (g): examination in view of possible biases, and measures to detect, prevent and mitigate them.

Article 10(6), as replaced: for a high-risk system that does not train models, those criteria apply to the testing data sets only.

What Complipath does

Risk classification Answers go through rules in code, never a language model, so the same answers always give the same result. Rules decide. AI only drafts. A person confirms.
Article mapping Each reason behind a verdict names the provision it rests on, so a reader can check it herself
Obligations per system Confirming a classification creates the obligations that follow from it, each with an owner, a status and a place for evidence
Evidence management A file linked to the requirements it proves, with the passage and its page

Rules decide. AI only drafts. A person confirms.

What it does not do yet

Customer questionnaires (audit room) Coming soon Coming soon: answering a customer's AI questionnaire from your own register.
Domain-specific guidance Not supported Guidance written for one sector.

Questions

Does Article 10 apply to us if we use a third-party model?

Article 10 binds high-risk AI systems, through their provider. If your system is high-risk and you are its provider, the data duties are yours even when the model is someone else's, and the information the model's provider owes you under Article 53(1), point (b) is part of your evidence. Article 53(2) lifts that duty for a model released under a free and open-source licence that allows access, usage, modification and distribution, with its weights and the information on its architecture and usage made public, and never for a model with systemic risk.

What does the example's model-provider sentence rest on?

On that provider's own terms, read and dated. For your answer, quote your providers' terms with the date you read them, and review them: a provider's terms are its state, and they can change without anything in your questionnaire changing with them.