The role of data protection authorities in supervising artificial intelligence should be central according to the European Data Protection Board (EDPB). Two other EU regulations in the field of digital business law in European law are the Digital Services Act (DSA) and the Digital Markets Act (DMA). An EU regulation is a legal act and is binding. Another piece of legislation that is also binding is EU directives, but only in terms of the result to be achieved.
Opinion of the European Data Protection Board on the role of data protection authorities in supervising artificial intelligence
In July 2024, the European Data Protection Board (EDPB) issued an opinion on the role of data protection authorities in supervising the AI Act. They concluded that AI systems are associated with personal data processing and therefore data protection authorities should play an important role. According to the Vice-President of the EDPB, the data protection authorities are suitable for carrying out this task.
High-risk artificial intelligence systems
As regards specifically certain high-risk artificial intelligence systems (i.e. high-risk AI systems), the EDPB recommends that data protection authorities supervise and monitor them. Among other things, when it comes to biometric identification, such as facial recognition, and whether it is legal under the GDPR. A practical example is border control. Biometric data constitutes sensitive personal data under the GDPR and therefore the requirements for such processing are stricter.
Designate authority
Please note that all EU countries must designate a national authority by 2 August 2025 to monitor the AI Act. The authority that countries designate as a market authority in accordance with the regulation will be a contact point for citizens and other stakeholders. According to the recommendation of the European Data Protection Board, it should be the data protection authority of the country as AI systems and personal data processing go hand in hand.