Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework
This statement by the European Data Protection Board (EDPB) addresses the role of national data protection authorities (DPAs) within the regulatory framework of the European Union's Artificial Intelligence Act. It highlights that EU data protection law and the AI Act are complementary, emphasizes the suitability of DPAs to act as market surveillance authorities for high-risk AI systems, and recommends close cooperation and adequate resourcing.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Member State governments, national regulators, and EU institutions seeking guidance on integrating data protection authorities into the AI Act enforcement framework.
What the document contains
The document addresses the supervision and coordination challenges arising from the designation of competent authorities under the AI Act, the role of data protection authorities as market surveillance authorities, and the necessity of cooperation between privacy regulators and AI governance bodies.
It does not provide detailed technical specifications for AI developers, nor does it establish binding legal rules outside of interpreting existing frameworks and making policy recommendations to Member States and EU institutions.
- The Artificial Intelligence Act and EU data protection legislation must be considered complementary and mutually reinforcing instruments.
- National data protection authorities possess established expertise in data security, computing, and fundamental rights assessments relevant to AI supervision.
- Member States should designate DPAs as market surveillance authorities for high-risk AI systems, particularly those impacting personal data rights and democratic order.
- DPAs acting as market surveillance authorities should serve as single points of contact for the public and counterparts at national and EU levels.
- Adequate human and financial resources must be provided by Member States to enable DPAs to effectively carry out their new AI supervisory tasks.
- Effective mutual cooperation must be established between the AI Office, the European Commission, the EDPB, and national DPAs.
1 BACKGROUND AND PURPOSE OF THIS STATEMENT 2 RECOMMENDATIONS
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Fairness
2/5Non-discrimination and equitable treatment
ensuring health, safety and a high level of protection of the fundamental rights enshrined in the Chart er of Fundamental Rights of the European Union
Section 1, paragraph 2
screening score · 2026-10-23
Human Dignity
3/5Respect for the inherent worth of persons
promoting the uptake of human-centric and trustworthy AI and ensuring health, safety and a high level of protection of the fundamental rights enshrined in the Chart er of Fundamental Rights of the European Union
Section 1, paragraph 2
screening score · 2026-10-23
Human Oversight
1/5Humans remain in control of consequential decisions
promoting the uptake of human-centric and trustworthy AI
Section 1, paragraph 2
screening score · 2026-10-23
Privacy
5/5Protection of personal data and private life
Union data protection law is fully applicable to the processing of personal data involved in the lifecycle of the AI systems, as explicitly recognised in Article 2(7) AI Act
Section 1, paragraph 3
screening score · 2026-10-23
Transparency
2/5Openness about how AI systems work and are used
the designation of DPAs as MSAs would benefit all stakeholders in the AI value chain by making available a single contact point, facilitating the interactions between different regulatory bodies
Section 1, paragraph 7
screening score · 2026-10-23
Enforcement
4/5Consequences and compliance mechanisms with real force
It has materialised in the EU jurisdictions through position papers, public consultations, parliamentary hearings, guidelines, opinions related to data protection impact assessments, investigations, corrective measures and (sometimes) sanctions.
Section 1, footnote 9
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
Moreover, in the light of the provisions contained in Articles 26(9), 27(4) and Annex VIII, Section C, point 5 AI Act, a close relationship is expected between the data protection impact assessment and the fundamental right impact assessment
Section 1, paragraph 8
screening score · 2026-10-23