ISO/IEC 5259 data quality, bias and robustness standards: 2026 table

ISO/IEC 5259 parts 1 to 5 are the International Standards for AI data quality, joined by Technical Report 5259-6 in May 2026. Bias and robustness guidance is mostly Technical Reports and Specifications, and EU AI Act Articles 10 and 15 bind high-risk systems from December 2027 or August 2028.

This guide is for data, AI assurance and compliance leads at GCC organisations that build, tune or buy models.

Which ISO/IEC documents cover AI data quality, bias and robustness?

IS means International Standard, TS Technical Specification and TR Technical Report. Status as listed by ISO on 4 October 2026.

ISO describes a TS as work still under technical development, published for immediate use and meant to become an IS later. A TR holds information of a different kind, such as survey data or the perceived state of the art.

So the requirements for an organisation sit mainly in ISO/IEC 5259-3:2024 and ISO/IEC 42001. The other International Standards give models, measures and methods. The TRs describe the state of the art, and the TSs give methods for immediate use. Treat the TRs as guidance, not requirements.

Three of these changes affect what you cite. TR 5259-6 made the series six parts, though some explainer pages still list five. The second edition of 25059 is renamed "Quality models for AI systems", and ISO's page expects it to replace the 2023 edition within months.

DIS 4213 will replace the classification-only TS 4213 with a wider International Standard. Until it publishes, TS 4213:2022 is the current document to cite in test plans.

Does ISO/IEC 42001 cover bias and data quality?

Through the management system, not through methods. ISO/IEC 42001:2023 requires an AI system impact assessment (clause 6.1.4). Its normative Annex A sets reference control objectives and controls, and Annex B gives implementation guidance. Certification bodies certify organisations against it.

It does not replace the method documents. When your impact assessment flags bias or data risk, TR 24027 and TS 12791 give the methods, and 5259-2 gives the data quality measures. Our ISO/IEC 42001 guide covers the management system itself.

At board level, 5259-5 explains the why and the who of data quality governance, not the how. It pairs with ISO/IEC 38507 on governing AI.

What do AI Act Articles 10 and 15 require, and from when?

Both sit in Chapter III of Regulation (EU) 2024/1689 and cover high-risk AI systems only. The Digital Omnibus on AI moved their dates. They now apply from 2 December 2027 for Annex III systems and 2 August 2028 for systems in Annex I products, instead of 2 August 2026 and 2027.

Article 10 covers training, validation and testing data. Article 10(2) lists the governance practices: design choices, data origin, preparation such as labelling and cleaning, assumptions, suitability, bias examination and mitigation, and data gaps. Article 10(3) asks for data sets that are relevant, sufficiently representative and, as far as possible, free of errors and complete.

Article 10(4) adds the geographical, contextual, behavioural or functional setting of use. If you train in one region and deploy in another, record how the data reflect where the system runs.

Article 15 requires appropriate accuracy, robustness and cybersecurity, performing consistently throughout the lifecycle. Accuracy levels and their metrics go into the instructions for use (Article 15(3)). Article 15(4) asks for resilience to errors and faults, and controls on feedback loops in systems that keep learning.

There are no AI Act decisions on either article yet, because neither applies before December 2027. The Commission has formally requested a European standard on managing bias, prEN 18283, to support the data governance requirements. CEN-CENELEC JTC 21 circulated a working draft in March 2026, so it is still a draft.

What did the Digital Omnibus change for bias-detection data?

Article 10(5) no longer exists. Regulation (EU) 2026/1744 deleted it and moved its content, with the same six conditions, to a new Article 4a(1). As a Chapter I provision, it has applied since the Omnibus took effect on 27 July 2026.

Providers of high-risk systems may process special categories of personal data for bias detection and correction only where strictly necessary, and only if other data, including synthetic or anonymised data, cannot do the job. The data need limits on re-use, state-of-the-art security and pseudonymisation, and strictly controlled, documented access. They must not pass to other parties.

Delete them once the bias is corrected or the retention period ends, whichever comes first. Your GDPR records of processing must say why the processing was strictly necessary.

A new Article 4a(2) extends the permission to providers and deployers of other AI systems and models, and to deployers of high-risk systems. It applies only where the bias is likely to harm health and safety or fundamental rights, or to cause unlawful discrimination. It also states that it creates no obligation to carry out bias detection. For the privacy side, see our ISO/IEC 27701 guide.

What evidence will an assessor or EU customer ask to see?

The AI Act's documentation rules name the records.

• Datasheets on training data: provenance, scope, main characteristics, how data were obtained and selected, and labelling and cleaning methods (Annex IV point 2(d)). 5259-4 covers labelling.
• Validation and testing procedures and data, metrics for accuracy, robustness and potentially discriminatory impacts, and dated, signed test logs (Annex IV point 2(g)). TS 4213 covers classification metrics.
• Expected accuracy overall and for specific persons or groups (Annex IV point 3).
• The accuracy level and metrics, and the robustness and cybersecurity tested against, in the instructions for use (Article 13(3)(b)(ii)).
• Data-management procedures inside the provider's quality management system (Article 17(1)(f)).
• Where special category data were used for bias work, the Article 4a(1) justification in your GDPR records.

Article 10(3) is easier to show with results measured against 5259-2 characteristics than with a policy statement.

How do GSO and SDAIA treat AI bias?

GSO adopted TR 24027 unchanged as GSO ISO/IEC TR 24027:2024, approved on 31 January 2024.

In Saudi Arabia, SDAIA's AI Ethics Principles (SDAIA-P114E, version 1, May 2025) apply to all AI stakeholders in the Kingdom. The fairness principle turns bias into controls. You choose fairness metrics by algorithm type, the effect of the decision and the harm of correct and incorrect predictions. You identify the sensitive attributes of disadvantaged groups and define the threshold between fair and unfair.

These line up with TR 24027 and TS 12791. SDAIA's reliability and safety principle also asks organisations to measure the quality, accuracy, suitability and credibility of data samples. For Saudi data protection, see our PDPL enforcement guide.

The UAE AI Charter lists algorithmic bias as principle 3. It is a charter of principles, not a regulation with metrics. We found no GCC rule that requires ISO/IEC 5259, 24029 or 25059.

How AGS can help

Two AGS kits support the ISO/IEC side of this work. Neither references the AI Act, and neither runs tests.

• AI Data Governance & Quality Management System: 234 documents (113 Word, 119 Excel, 2 PDF), built on ISO/IEC 5259-3:2024 and cross-referenced to ISO/IEC 42001:2023 and ISO/IEC 38505.
• AI Performance, Bias & Robustness Management System: 219 documents (95 Word, 122 Excel, 2 PDF), including an AI Bias Assessment Methodology and crosswalks to TS 4213, TR 24027 and TR 24029-1.

Frequently asked questions

Does the EU AI Act apply to a GCC company selling AI into the EU?

It can. Article 2(1) covers providers placing AI systems on the EU market wherever they are established, and non-EU providers and deployers whose system's output is used in the EU. Articles 10 and 15 then apply only if the system is high-risk.

Does the AI Act prescribe an accuracy metric?

No. Article 15(2) has the Commission encourage benchmarks and measurement methods with metrology and benchmarking authorities. You choose the metrics and declare them.

Does the NIST AI RMF cover bias?

Yes, on a voluntary basis. NIST AI 100-1, released on 26 January 2023, names systemic, computational and statistical, and human-cognitive bias. MEASURE 2.11 asks for fairness and bias to be evaluated and documented. NIST says the framework is being revised and offers an Arabic translation.

AGS provides independent documentation toolkits. This guide and the referenced kits are not affiliated with, endorsed by or approved by ISO, IEC, the European Commission, GSO, SDAIA or any national authority. It is general information, not legal advice.

Reviewed October 2026. Facts checked against the sources current at publication.