Data governance for AI under the EU AI Act

Summary

• The EU AI Act imposes mandatory data governance controls on high-risk AI systems, including data lineage, access control, audit trails, and purpose limitation.
• Data governance for EU AI Act compliance requires documenting data provenance, enforcing role-based access, maintaining activity logs, and classifying data by sensitivity and regulatory purpose.
• Unity Catalog provides centralized metadata management, role-based access control, audit logging, and data lineage capabilities to meet EU AI Act governance requirements.
• Organizations deploying high-risk AI in the EU must implement governance frameworks that track who accessed what data, when, and why.

Data governance for AI under the EU AI Act
Data governance under the EU AI Act is a set of practices and technical controls that ensure high-risk AI systems use data responsibly, transparently, and in compliance with regulatory obligations. The law requires organizations to document data sources, control who accesses training and inference data, maintain audit trails, and enforce purpose limitation (ensuring data is used only for its specified AI function). For organizations building or deploying AI in the EU, data governance is no longer optional: it's a legal requirement that directly determines your AI system's compliance posture.

What is the EU AI Act?

The EU AI Act, which entered into force in 2024 and becomes enforceable in 2026, is a risk-based framework for regulating artificial intelligence. It classifies AI systems into four tiers: prohibited (e.g., facial recognition in public spaces), high-risk (e.g., AI used for hiring, creditworthiness, or critical infrastructure), transparency-risk (e.g., chatbots and image generators), and low-risk or unregulated. High-risk AI systems trigger the most stringent governance requirements, including mandatory data documentation, access controls, bias monitoring, and logging. For organizations operating in Europe or serving European users, compliance is mandatory regardless of where the AI model is trained or deployed.

Key data governance considerations for AI compliance

When evaluating governance platforms and practices to meet EU AI Act requirements, organizations should assess these capabilities:

Capability	Why it matters
Data lineage and provenance	Document where training data originated, how it was processed, and who had access. High-risk AI requires clear traceability from raw data to model inputs.
Role-based access control (RBAC)	Restrict data access to only those with legitimate business or regulatory purpose. The principle of least privilege limits exposure and supports purpose limitation.
Audit logging and activity trails	Record all data access, modifications, and policy changes with timestamps and user identity. Audit logs are central evidence of compliance.
Data classification and tagging	Mark data by sensitivity (personal, financial, health) and compliance tag (GDPR, AI Act, industry-specific). This enables enforcement of purpose-based policies.
Policy enforcement and monitoring	Automatically prevent unauthorized access patterns and alert on policy violations. Real-time enforcement reduces compliance risk.
Cross-team and cross-workspace governance	Govern data consistently across data teams, ML teams, and geographic regions. Fragmented governance creates blind spots.
Data retention and deletion controls	Enforce retention schedules and support right-to-deletion (GDPR erasure requests). Retaining data beyond its purpose violates purpose limitation.

How Databricks approaches data governance for AI

Unity Catalog is Databricks' centralized governance platform, built to address the specific demands of high-risk AI. Here's how it supports EU AI Act compliance:
Centralized metadata and lineage. Unity Catalog shows which datasets trained which models and which data flows into inference pipelines, providing the lineage evidence required by the EU AI Act.
Role-based access control. Granular RBAC at schema, table, and column levels restricts high-risk training data to approved teams and prevents unauthorized data movement between environments.
Audit logging. All data access, metadata changes, and policy updates are logged with full context (who, what, when, why), creating audit trails for regulator compliance.
Data tagging for compliance. Mark datasets as "PII", "training data", "high-risk AI", or region-specific ("GDPR", "CCPA") to enforce rules like "PII tagged data cannot leave the EU" or prevent dataset reuse.
Governance policies. Fine-grained policies enforce time-bound access rules that revoke automatically, or purpose-limited data access tied to specific AI projects.

Use cases

Financial services. A bank building a loan-decisioning AI system must document that training data is representative and used only for that purpose. Unity Catalog's lineage and tagging prevent accidental reuse for other purposes and provide regulators an audit trail of exact data versions.
Healthcare. Organizations deploying AI for patient outcome prediction must control access to medical records and support GDPR erasure requests. Unity Catalog's column-level access and retention policies enforce these requirements.
Hiring and recruiting. Resume data used in AI-driven hiring is explicitly high-risk under the EU AI Act. Unity Catalog isolates such data from other HR datasets and ensures it's deleted after the hire/no-hire decision.

FAQs

Does Unity Catalog automatically make my AI system EU AI Act compliant?

No. Unity Catalog provides the technical infrastructure for governance, but compliance is an organizational responsibility. You must still conduct risk assessments, document your AI system's risk tier, implement appropriate policies in Catalog, and maintain a compliance audit trail. Catalog is the enabler, not a substitute for compliance planning.

What happens if I don't implement data governance for high-risk AI?

Under the EU AI Act, non-compliance can result in significant fines for prohibited or high-risk violations. Additionally, regulators can ban the AI system from the EU market. Governance isn't optional for any organization deploying high-risk AI in Europe.

Can I use Unity Catalog if my data is outside the EU?

Yes. The EU AI Act applies based on where the AI system is used or affects EU residents, not where the data is stored. However, you may have additional requirements (like data localization or transfer restrictions) depending on your specific use case. Unity Catalog supports governance across cloud regions and can help enforce geographic controls.

How does data tagging in Unity Catalog help with AI Act compliance?

Tagging lets you mark datasets by their purpose, sensitivity, and regulatory scope. You can then write policies that enforce compliance rules automatically. For example, a "training-only" tag can be used to prevent that dataset from being accessed for other purposes. Tags are queryable in audit logs, providing clear evidence that you're enforcing purpose limitation.