Statement 3/2024 on data protection authorities' role in the Artificial Intelligence Act framework

The EDPB states that the AI Act and EU data protection law complement each other and must be interpreted in a coordinated manner, referring explicitly to Article 2(7) and recitals 9 and 10. It advises Member States to designate national data protection authorities as market surveillance authorities, mandatory for high-risk systems in Annex III points 1, 6, 7 and 8 and preferably also more broadly. The EDPB also points to the close link between the data protection impact assessment (DPIA) and the fundamental rights impact assessment, and to the absence of structured coordination between the AI Office and data protection authorities on general-purpose AI models.