EDPS updates generative AI guidance for EU institutions

The European Data Protection Supervisor (EDPS) has released revised guidance on the use of generative AI by EU institutions, bodies, offices, and agencies (EUIs), aligning practice with Regulation (EU) 2018/1725. The update responds to rapid technological change and feedback from EUIs, providing clearer, operational instructions for compliant deployment of generative AI systems.

Key updates include a refined definition of generative AI, a practical compliance checklist, and clarified roles and accountability for controllers and processors. The guidance offers detailed advice on lawful processing, data minimization, transparency, and rights of individuals, including access, rectification, objection, and safeguards against automated decision-making.

The EDPS underscores that the guidance supports innovation while maintaining high data protection standards. It aims to ensure that generative AI serves the public interest, with concrete measures for risk assessment, vendor due diligence, and contractual controls, particularly for cloud-based and API-accessed models.

Issued in the EDPS’s capacity as the independent data protection authority for EU institutions, the guidance is distinct from market surveillance functions under the EU Artificial Intelligence Act. The EDPS commits to ongoing monitoring and iterative updates to address emerging risks and ensure continued compliance and accountability.