Keep It Secret, Keep It (in a) Safe, Then Cast It into the Fire: Engineering AI Act Data Governance — A Practical Guide for Data Teams

Data Vault preserves history; data protection can require parts of that history to be erased. The EU AI Act adds bias-detection and correction duties that may depend on sensitive attributes whose processing the GDPR restricts. Reconciling these demands requires decisions about data collection, storage, transformation, release, use and deletion. This paper maps selected AI Act data obligations to those decisions, using Data Vault 2.x and a recruitment-screening example. Article 4a receives particular attention: its permission to process sensitive data carries six cumulative safeguards, including deletion at the earlier of bias correction or retention expiry. The implementation patterns connect each relevant requirement to evidence, an accountable owner and a test. They support lawful processing without supplying a missing legal basis, resolving contested interpretations or replacing the Act’s wider organisational requirements. This paper provides general legal and architectural analysis. Specific systems require advice from qualified counsel. The architectures, owner assignments and tests are suggested engineering practices; statutory duties and conditions are identified by their provisions.