The EDPS is an independent institution of the EU responsible for ensuring data protection rights are respected by EU bodies and for advising EU bodies and data subjects on all matters concerning the processing of personal data. When proposing new data protection laws, the European Commission is required to consult the EDPS.

The Commission’s original proposal for an AI Act proposes that certain types of AI systems would be banned (e.g. those using subliminal techniques), other types would be defined as high-risk (e.g. those used for biometric identification or categorisation, in education, HR decision making or credit checks) and would be subject to a number of safeguards (e.g. conformity assessments, prior registration regime, risk management, appropriate human oversight etc) and those systems which would be low risk and subject only to certain transparency requirements.  The AI Act is currently being negotiated in trilogue by the EU legislative bodies, the Commission, Council and Parliament.

In its latest Opinion on the AI Act, published on 23 October 2023, the EDPS makes several further recommendations, some of which are set out below, to be considered during these discussions.

The Commission’s original proposal for the AI Act provides that the Act would not apply to high-risk AI that is already on the market when the AI Act comes into force unless it becomes subject to “significant changes”. The EDPS suggests that the AI Act should apply to all high-risk AI existing at that date. Further, the AI Act applies to “providers” which are defined as those who develop AI systems. The EDPS recommends that operators involved in re-training pre-trained AI systems (i.e. updating a trained model by training it with different data) should also qualify as providers.

Under the original proposal, certain large-scale IT systems used in the areas of travel, security and justice would be excluded from the operation of the AI Act. The EDPS recommends removing this exemption to ensure such systems are subject to the safeguards under the AI Act. The EDPS also recommends removing the exclusion from the scope of the AI Act systems to be used in the context of international law enforcement cooperation.

The Council has suggested that high risk AI should not include a “system that is purely accessory in respect of the relevant action or decision to be taken” and the Parliament suggested high risk AI should not include a system that does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons. The EDPS believes these proposals, if adopted, will lead to legal uncertainty and recommends that these exclusions are not included in the final law.

Finally, the AI Act proposes that the EDPS would act as a supervisory authority, a conformity assessment body (“notified body”) and a market surveillance authority under the AI Act in respect of AI systems intended for use by EU institutions, bodies, offices and agencies. The EDPS recommends that its role and responsibilities should be further clarified (including a right for individuals affected by AI systems to lodge complaints the with the EDPS and other supervisory authorities), and that the AI Act should guarantee adequate financial and human resources to the EDPS to enable it carry out these functions.

For more information, click here.