Bias in an AI system is a systematic skew in its outputs that disadvantages particular people or groups and can amount to discrimination. AI ethics is now a set of concrete duties: the EU AI Act asks for bias examination of data and human oversight, and an amendment adopted in July 2026 reshaped several of those rules and deadlines.
Quick Overview
What you will learn:
- Where model bias comes from, and why dropping sensitive columns rarely fixes it
- Which AI Act articles deal with data, bias and human oversight
- What the Digital Omnibus on AI changed and which deadlines apply now
- How a team can measure whether a model treats groups fairly
Who this article is for:
- Product owners and AI project managers
- Data science and machine learning teams
- Compliance, risk and data protection specialists
Reading time: 7 minutes
Where bias comes from
A model learns from data, and data records the world as it was. If past lending or hiring decisions were uneven, the model picks up that pattern and repeats it at scale. Removing a “gender” or “age” column seldom helps, because postcodes, career gaps or job titles can act as proxies.
NIST’s special publication SP 1270, listed on www.nist.gov, argues that bias is not only a data problem. It describes systemic bias (rooted in the practices of institutions), statistical and computational bias (for example, unrepresentative samples) and human bias (systematic errors in how people interpret and use outputs). The practical lesson: a fairness review has to look at the whole lifecycle, including who decided the system was needed and how its results will be acted on, not just at the training set.
What the AI Act asks for
Regulation (EU) 2024/1689, the AI Act, published on eur-lex.europa.eu, places most of its bias rules in the requirements for high-risk AI systems:
- Article 10(2)(f) and (g) — data governance must cover examination for possible biases and measures to detect, prevent and mitigate them.
- Article 10(3) — training, validation and testing data sets must be relevant, sufficiently representative and, to the best extent possible, free of errors.
- Article 14 — human oversight. The people assigned to it must understand the system’s capacities and limitations, stay aware of automation bias and be able to disregard, override or reverse an output.
The duties are split by role. The provider designs the data practices and oversight measures; the deployer uses the system according to the instructions and assigns competent people to oversee it.
What changed: the timeline and the amendment
Under Article 113 of the text on eur-lex.europa.eu, Chapters I and II, including the prohibited practices in Article 5 and the AI literacy provision in Article 4, have applied since 2 February 2025.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was signed on 8 July 2026 and entered into force on 27 July 2026; its text is on eur-lex.europa.eu. The changes that matter for ethics and bias:
- A new Article 4a. The exceptional legal basis for processing special categories of personal data to detect and correct bias moved out of Article 10(5), which was deleted. It now also covers deployers of high-risk systems and providers and deployers of other AI systems and models. The safeguards stay strict: no effective alternative using synthetic or anonymised data, pseudonymisation, access controls, deletion once the bias is corrected, and a recorded justification. Paragraph 2 states that it creates no obligation to run such checks.
- A rewritten Article 4. Providers and deployers must take measures that support the development of AI literacy among their staff, without having to guarantee any particular level for any individual.
- New Article 5 prohibitions on systems that generate non-consensual intimate imagery of identifiable people and child sexual abuse material, applying from 2 December 2026.
- Later high-risk deadlines. Chapter III, Sections 1 to 3, which include Articles 10 and 14, now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.
Outside the EU, the reference point is the NIST AI Risk Management Framework. NIST’s page on www.nist.gov notes that AI RMF 1.0, released on 26 January 2023, is being revised, and that a concept note for a critical infrastructure profile followed on 7 April 2026.
Measuring fairness in practice
The later deadlines are not a reason to wait: data practices take time to build. Microsoft’s Azure Machine Learning documentation on learn.microsoft.com, which builds on the open-source Fairlearn package, frames fairness around two harms. An allocation harm occurs when a system extends or withholds opportunities, resources or information for certain groups; a quality-of-service harm occurs when it simply works worse for one group.
A common starting point is the disparity in selection rate between groups, such as loan approval rates. Fairlearn supports parity constraints: demographic parity to mitigate allocation harms, and equalized odds and equal opportunity to diagnose allocation and quality-of-service harms in binary classification. Picking the metric is a team decision that needs a written rationale, and the documentation stresses that a fairness assessment is not a purely technical exercise.
A workable sequence:
- List the groups the system will be used on and the sensitive features involved.
- Break model results down by group and record the chosen metric and why.
- Plan the correction: better data, a different decision threshold or a mitigation algorithm.
- Name the oversight owner and define when they may stop the system or reject an output.
Read Also
- AI Act: what changes for IT teams — the requirement calendar after the amendment
- AI Act and team competencies — preparing people to work with AI
- IT risk management in practice — a risk register where AI risks belong too
Build Your Skills
Two trainings cover this ground: Ethics and Responsible Artificial Intelligence in Business and Explainable Artificial Intelligence — EU AI Act, LIME/SHAP and AI Ethics for Boards of Directors. The first deals with algorithmic bias and AI governance, the second with fairness metrics and model explainability. Get in touch to shape the scope around your team.
Frequently Asked Questions (FAQ)
What does AI ethics mean for a business in practice?
It means deciding how an AI system treats people: whose data it relies on, whom a wrong output could harm and who answers for the result. Day to day, that translates into measuring bias, documenting design choices and naming people who oversee the system and can overrule it.
How does the amended AI Act affect companies?
According to the acts on eur-lex.europa.eu, the Article 5 bans have applied since 2 February 2025 and the bans added by the amendment apply from 2 December 2026. High-risk requirements now start on 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Companies should map which of their systems could fall into these categories and prepare data and oversight ahead of time.
Do employees need AI Act training?
Article 4, as rewritten by Regulation (EU) 2026/1744 (eur-lex.europa.eu), requires providers and deployers to take measures that support the AI literacy of their staff, taking into account the context in which systems are used. It prescribes no format and does not require a guaranteed level of knowledge, so training is one possible measure rather than the only one.
What bias rules apply to high-risk AI systems?
Article 10(2)(f) and (g) of the AI Act (eur-lex.europa.eu) requires examining data for possible biases and taking measures to detect and mitigate them, while Article 14 requires effective human oversight. Special categories of personal data may be processed for that purpose only exceptionally, under Article 4a, when synthetic or anonymised data cannot do the job.