EDPS launches first mapping of AI systems in EU institutions
The European Data Protection Supervisor (EDPS) has begun operationalizing its new role under the EU Artificial Intelligence Act as the market surveillance authority for AI systems used by EU Institutions, Agencies and Bodies (EUIs). Following the creation of a dedicated EDPS Artificial Intelligence Unit in October 2024, the authority, together with AI Act Correspondents in the EUIs, launched one of the first preliminary mapping exercises by a market surveillance authority under the AI Act. This exercise focused on identifying AI systems that could be considered high-risk, whether already in use or planned, and produced the first report published by the EDPS in its new supervisory capacity, highlighting the diversity of AI systems already present within the EUI ecosystem.
The mapping exercise pursued three main objectives: to encourage EUIs to establish early inventories and gain a clear understanding of the AI systems they deploy; to identify the specific features of AI use in the EU public administration so that future implementing rules and guidance under the AI Act reflect these particularities; and to support the EDPS in preparing for its responsibilities as both market surveillance authority and notified body. By collecting structured information from EUIs, the EDPS obtained an overview of the “market” it will supervise, enabling it to refine its strategic planning and identify areas where interpretative guidance or practical support will be needed.
The findings point to several important takeaways for future implementation. None of the participating EUIs reported either in-use or planned AI practices that would be prohibited under Article 5 AI Act. At the same time, EUIs are encountering difficulties when determining whether a given system qualifies as high-risk and in applying the exemption filter under Article 6(3), which excludes certain systems in narrowly defined circumstances. The EDPS underlines the need to “de-mystify” high-risk AI systems: classification as high-risk does not prohibit use but instead triggers compliance with a specific set of legal obligations and safeguards, which, if met, allow institutions to harness efficiency and other benefits.
The report also signals future areas of focus for the EDPS AI Unit. AI systems deployed within the Area of Freedom, Security and Justice are expected to attract particular supervisory attention, given their sensitivity and potential impact on fundamental rights. In addition, the growing use of AI tools in recruitment, especially job-matching services, is identified as a trend that is likely to expand and will require close scrutiny. The mapping exercise was conducted within the AI Act Correspondents Network (AIACN), a cooperation platform initiated by the EDPS after the AI Act’s entry into force in August 2024; originally informal, the AIACN was formally established in September 2024 and now convenes twice yearly, illustrating the value of early coordination across EU public administration on AI governance.
