In July, Europe gave AI builders more time. The Digital Omnibus pushed the EU AI Act's high-risk obligations from August 2026 to 2 December 2027, and to August 2028 for AI built into regulated products such as medical devices and machinery.
Some teams read that as a reason to wait. We read it differently. A model that ships in 2028 is being trained on data labelled today. If that data cannot explain where it came from and how it was labelled, the delay only postpones the problem.
The rules did not get softer. Only the date changed.
The law names labelling
Article 10 of the Act covers the training, validation and test data behind high-risk AI. It asks providers to document how that data was collected, where it came from and how it was prepared. Annotation and labelling are named in the text directly, alongside cleaning and enrichment.
It goes further than paperwork. Providers must examine their data for possible bias, take steps to reduce it and record the gaps they could not close. Datasets have to be relevant, representative and, as far as possible, free of errors.
Put plainly, a label is no longer just a label. It is evidence.
Your data partner sits inside the obligation
The legal duty belongs to the company that builds and sells the AI system. That company rarely labels its own data. When a partner does the work, the partner holds the records the provider will one day need to show.
That makes choosing an annotation partner a compliance decision. A partner that cannot produce its guidelines, its quality results and the names of the people who did the work leaves a gap no one can fill later. You cannot rebuild an audit trail for data labelled two years ago.
What audit-ready annotation looks like
Five standards separate a partner who labels data from one who can stand behind it.
- Guidelines with a history. Every label should trace back to the instruction in force when it was made. When the rules change mid-project, the record shows what changed, when and why.
- Named, trained people. Anonymous crowds leave nothing to audit. Each labelling decision should lead back to a trained person on an accountable team.
- Quality that is measured, not claimed. Agreement between annotators, review rates and error findings belong in a record for every batch, not in one summary at the end.
- Bias checks built into the work. The people closest to the data often spot the gaps first: missing groups, skewed samples, cases the guidelines never imagined. A good partner reports them in writing.
- A clean chain of custody. Where the data lived, who could reach it and when it was deleted should all be on record. Here is the security standard we hold ourselves to.
Built for scrutiny from day one
Impact Outsourcing was founded in Nairobi in 2021 on a simple view: training data should hold up when someone checks it. Our team works full time on named projects with one delivery lead accountable for the work. No operator joins live work before completing at least three weeks of calibration on gold standard data. Our information security program is certified to ISO 27001 and independently audited.
That is how we hand clients more than labels. We hand them a record of how those labels were made.
The teams that use this extra time well will reach December 2027 with data they can defend. The teams that wait will be rebuilding datasets against a deadline. Whichever partner you choose, hold them to the five standards above now, while there is still time to act on the answers.
Want to see what an audit-ready annotation workflow looks like in practice? Talk to our team.
Frequently asked questions
When do the EU AI Act's training data rules apply?
The high-risk rules, including Article 10 on data, apply from 2 December 2027 for stand-alone high-risk systems such as hiring, credit scoring and education tools. AI built into regulated products such as medical devices follows on 2 August 2028. Other parts of the Act, including its transparency rules, already apply.
Does the EU AI Act apply to annotation partners outside Europe?
The obligations fall on providers placing high-risk AI on the EU market, wherever those providers are based. Annotation partners are not bound directly, but providers depend on their records to comply. That puts partners in Kenya and elsewhere firmly inside the chain.
What does Article 10 require?
Documented governance of training, validation and test data. That covers how data was collected, where it came from, how it was prepared and labelled, how it was checked for bias and which gaps remain.
What should I ask an annotation partner about EU AI Act readiness?
Ask for versioned guidelines, quality results for each batch, who labelled the data, how bias issues are reported and how access and deletion are recorded.