Article 10(2)(b)
data governance and management practices
Per-project data governance manifest
Sub-processor list, sampling methodology, and QA audit log shipped per project.
Data Collection
Audio, image, video, LiDAR, text, TTS, transcription, and parallel corpus. Per-contributor GDPR consent. EEA-resident contributor network. EU AI Act Article 10 documentation shipped with every project.
Norwegian legal entity. Reply within one business day.
Modality Coverage
Most vendors split data collection across separate service lines, each with its own legal instrument. YPAI runs audio, image, video, LiDAR, text, TTS, transcription, and parallel corpus under one master DPA, one consent layer, and one delivery contract.
Consent Chain
Marketplace consent is platform Terms of Service: bundled, aggregate, and not GDPR Article 7 valid for biometric voice or facial data. YPAI consent is recorded per contributor, per project, with Article 9 special-category handling separated and a 30-day erasure SLA.
Regulatory Alignment
Article 10 sets data-governance obligations for high-risk AI systems. YPAI ships the documentation that supports your conformity assessment. We do not certify your AI system; we provide the evidence pack your assessment needs.
Article 10(2)(b)
data governance and management practices
Sub-processor list, sampling methodology, and QA audit log shipped per project.
Article 10(3)
relevant statistical properties
Per-recording demographic, dialect, and locale metadata. Aggregate distribution report per project.
Article 10(4)
examination in view of possible biases
Sampling methodology, demographic coverage report, and known-gap declarations included in the deliverable bundle.
Article 10(5)
processing of special categories of personal data
Special-category consent records, erasure-receipt log, and purpose-limited retention attestations.
Contributor Network
Identity-verified network with documented EEA residency, demographic metadata per contributor, and self-hosted EU annotation infrastructure. Not a marketplace crowd: a vetted network with individual-level provenance.
Verified contributors
Identity-verified at intake
Languages and locales
Documented per-language coverage
Countries reached
EEA-resident contributor network
Jurisdiction
Norwegian legal entity, not CLOUD Act
Coverage is organised in four language families plus a regulated-vertical lexicon overlay. The exact pair list and per-pair throughput are confirmed at project scoping; below are the groups in scope.
Pair-level throughput, post-edit quality grade, and reviewer credentials confirmed at project scoping. DPA and Article 28 clauses are included by default, not on request.
Deliverable Evidence Pack
On delivery you receive the data plus a structured evidence bundle your DPO, legal counsel, and procurement team can review without follow-up. Master DPA included by default, not on request.
project-deliverable/
consent-records/ [per-contributor]
consent-{id}.json [signed]
article-9-special-category/ [separated pack]
provenance/ [per-recording]
recording-{id}.json [tamper-evident]
device-locale-dialect-metadata/
qa-logs/ [immutable versioning]
demographic-metadata.csv [aggregate + per-record]
sampling-methodology.pdf [bias-audit input]
bias-audit-log.pdf [Article 10(4)]
sub-processor-list.pdf [transparency]
erasure-receipts.log [30-day SLA]
DPA.pdf [signed, project-scoped] consent-records/
One JSON per contributor with the Article 7 capture, separated Article 9 evidence if applicable, and the documented revocation pathway.
provenance/
Per-recording manifest with device, locale, dialect, and tamper-evident signing on the consent and metadata bundle.
qa-logs/ and bias-audit-log.pdf
Documentation supporting your EU AI Act Article 10(4) bias examination. Sampling methodology, demographic coverage, and known-gap declarations included.
DPA.pdf and erasure-receipts.log
Master DPA signed and project-scoped, included with every engagement. Erasure-receipt log tracks the 30-day SLA at the per-record level.
Next Step
Tell us the modality, the regulatory context, and the volume. We map a delivery plan with the consent chain, evidence pack, and master DPA included by default.
EU AI Act Article 10 applies from 2026-08-02. Cumulative GDPR fines have passed EUR 7.1B. The cost of getting data provenance wrong is procurement-blocking; the cost of getting it right is a conversation.
Master DPA included with every YPAI engagement, not on request. Norwegian legal entity. Reply within one business day.
DATA COLLECTION INTAKE
Bring modality, environment, volume estimate, and any regulatory constraints. A named project lead replies within one EU business day with a feasibility read.
GDPR Article 7 ยท GDPR Article 9 ยท EU AI Act Article 10
What happens next
Three states this serves: you have submitted and want to know the timing, you are about to submit and have a procurement objection, or you are not ready to submit and want a route deeper into the work.
Add YPAI to your home screen
Tap the Share button, then Add to Home Screen.