Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework
This statement by the European Data Protection Board outlines the role of data protection authorities in the implementation and enforcement framework of the EU Artificial Intelligence Act. It recommends that Member States designate data protection authorities as market surveillance authorities for high-risk AI systems and points of contact. Furthermore, it emphasizes the need for complementary enforcement, adequate resources, and effective cooperation between data protection authorities and the EU AI Office.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Member State governments and regulatory authorities responsible for implementing the AI Act enforcement framework.
What the document contains
The document addresses the designation of national competent authorities and market surveillance authorities under the AI Act, the interplay between the AI Act and EU data protection laws like the GDPR, and the necessity of coordination between data protection authorities and the EU AI Office.
The text does not provide technical specifications for AI models or detailed penalty structures for non-compliance outside of governance and enforcement coordination.
- EU data protection legislation and the AI Act must be interpreted as complementary and mutually reinforcing instruments.
- National data protection authorities possess established expertise and independence, making them well-suited to supervise AI systems.
- Member States are recommended to designate data protection authorities as market surveillance authorities for high-risk AI systems under the AI Act.
- Data protection authorities acting as market surveillance authorities should serve as single points of contact for the public and counterparts.
- Proper coordination and cooperation mechanisms must be established between the AI Office, the EDPB, and national data protection authorities.
1 BACKGROUND AND PURPOSE OF THIS STATEMENT 2 RECOMMENDATIONS
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Fairness
1/5Non-discrimination and equitable treatment
ensuring health, safety and a high level of protection of the fundamental rights
Paragraph 2
screening score · 2026-10-23
Human Dignity
0/5Respect for the inherent worth of persons
screening score · 2026-10-23
Human Oversight
0/5Humans remain in control of consequential decisions
screening score · 2026-10-23
Privacy
5/5Protection of personal data and private life
Union data protection law is fully applicable to the processing of personal data involved in the lifecycle of the AI systems, as explicitly recognised in Article 2(7) AI Act
Paragraph 3
screening score · 2026-10-23
Transparency
1/5Openness about how AI systems work and are used
designated as the single points of contact for the public and counterparts at Member State and Union levels
Paragraph 10
screening score · 2026-10-23
Enforcement
4/5Consequences and compliance mechanisms with real force
It has materialised in the EU jurisdictions through position papers, public consultations, parliamentary hearings, guidelines, opinions related to data protection impact assessments, investigations, corrective measures and (sometimes) sanctions.
Footnote 9
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
Moreover, in the light of the provisions contained in Articles 26(9), 27(4) and Annex VIII, Section C, point 5 AI Act, a close relationship is expected between the data protection impact assessment and the fundamental right impact assessment
Paragraph 8
screening score · 2026-10-23