The European Data Protection Supervisor (EDPS) published the guidelines on generative artificial intelligence (GenAI) and personal data for EU institutions. The guidelines aim to help institutions comply with the data protection obligations set out in the EU Regulation 2018/1725, when using or developing GenAI tools. EDPS noted that it has not issued these guidelines within its role as AI Supervisor of the EU institutions under the Artificial Intelligence Act, for which a separate strategy is being prepared. The official EU AI Act was published on July 12, 2024, with the Act being applicable from August 02, 2026, with certain exceptions.
The GenAI and personal data guidelines define GenAI, establish whether and how EU institutions can use GenAI, and address the following aspects:
Understanding whether use of a GenAI system involves personal data processing
Role of a data protection officer in the process of development or deployment of GenAI systems
When should a data protection impact assessment be conducted
When the processing of personal data during the design, development, and validation of GenAI systems lawful
How can the principle of data minimization be guaranteed when using GenAI
Whether GenAI system is respectful of the data accuracy principle
Informing individuals about processing of personal data when institutions use GenAI systems
Clarification on the automated decisions within the meaning of Article 24 of the Regulation
Ensuring fair processing, avoiding bias when using GenAI systems, exercise of individual rights, and data security
This initial guidance serves as a preliminary step toward the development of more comprehensive guidance. Over time, these guidelines will be updated, refined, and expanded to address further elements needed to support EU institutions in the development and implementation of GenAI systems. Such an update is expected to be issued no later than twelve months after the publication of this document.
Related links
LEARN MORE
Find out how we can help
Moody’s brings together data, experience, and best practice capabilities, with our specialized and agile intelligence.