# EDPB-EDPS Joint opinion 1/2026 on the Proposal for a Regulation as regards the simplification of the implementation of harmonised rules on artificial intelligence

- Type: Guidance
- Source: EDPB
- Identifier: edpb-edps-joint-opinion-12026-proposal-en
- Date: 2026-01-21
- Original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-12026-on-the-proposal-for-a-regulation-as_en
- Canonical: https://overview.legal/posts/53738
- Topics: Artificial Intelligence, Annex III Amendments, AI Value Chain Actors and Roles, AI Risk Assessment, AI Standards, Authority Cooperation, Cross-Regulation Integration: AI Act and Sectoral Requirements, Mutual Assistance Between Member States for AI Oversight, Market Surveillance Corrective Actions and Enforcement, Market Surveillance and Control of AI Systems

## Summary

EDPB, EDPB-EDPS Joint opinion 1/2026 on the Proposal for a Regulation as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)

## Full text

EDPB-EDPS JOINT OPINION 1/2026 On the Proposal for a Regulation as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) Adopted on 20 January 2026 2 Adopted 3 Adopted Executive summary On 19 November 2025, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (hereafter, ‘the Proposal’). On 25 November 2025, the Commission formally consulted the EDPB and the EDPS in accordance with Article 42(2) of Regulation (EU) 2018/1725. The EDPB and the EDPS support the Proposal’s general objective to address certain implementation challenges of Regulation (EU) 2024/1689 (the ‘AI Act’), with a view to the effective application of the relevant rules. In the same spirit, they recall that the EDPB and the European Commission are working on joint guidelines on the interplay between the GDPR and the AI Act to be issued later this year. Processing of special categories of personal data for bias detection and correction The EDPB and the EDPS support in principle the proposed extension of the legal basis allowing the exceptional processing of special categories of personal data for purposes of bias detection and correction. At the same time, to avoid potential abuse, the cases where providers and deployers would be able to rely on this legal ground in the context of non-high risk AI systems and models should be clearly circumscribed and limited to cases where the risk of adverse effects caused by such bias is sufficiently serious. In the same vein, the EDPB and the EDPS recommend maintaining the standard of strict necessity currently applying for the processing of special categories of personal data for bias detection and correction in relation to high-risk AI systems. Registration and documentation The EDPB and the EDPS support the general aim of the Proposal to ease administrative burdens for operators. However, they recommend maintaining the obligation for providers to register AI systems in the EU database for high-risk systems also in the cases where the provider has concluded the system is - despite being referred to in Annex III AI Act - not high- risk. The proposed deletion of such registration obligation would significantly decrease the accountability of providers of AI systems and would provide an undesirable incentive for providers to unduly invoke this exemption. AI regulatory sandboxes at EU level The EDPB and the EDPS support the creation of EU-level AI regulatory sandboxes to promote innovation and help small and medium-sized enterprises (‘SMEs’) across the EEA. However, they suggest improvements to ensure better legal certainty: - competent Data Protection Authorities (DPAs) should be involved in the operation and supervision of the corresponding data processing carried out in these sandboxes, in line with Regulation (EU) 2016/679 (‘the GDPR’); - the competence of DPAs in these sandboxes and its interplay with the GDPR cooperation mechanism should be clarified; - the EDPB should have (1) an advisory role to ensure consistency on data protection aspects, specifically in cases where several DPAs would be concerned by the EU-level AI sandbox, and (2) the status of observer at the European Artificial Intelligence Board. 4 Adopted Supervision and enforcement by the AI Office The EDPB and the EDPS welcome the introduction of the requirement for active cooperation between the AI Office and authorities involved in the application of AI Act for the supervision of AI systems based on a general-purpose AI model, where the provider of the model is also the provider of the system. Whenever necessary, close cooperation should take place, as well as close coordination with the competent DPAs where there are risks to the fundamental rights to privacy and data protection. Moreover, the EDPB and the EDPS recommend to clearly delimitate the types of general-purpose AI models that would trigger the exclusive competence of the AI Office, to ensure effective supervision of such AI systems. In addition, the EDPB and the EDPS positively note the recital clarifying that the AI Office would not be competent for AI systems placed on the market, put into service or used by Union institutions, bodies, offices or agencies, which are under the supervision of the EDPS. In the interest of legal certainty and independence of the supervision, the EDPB and the EDPS recommend introducing such clarification in the enacting terms. Powers of authorities/bodies protecting fundamental rights and cooperation with MSA The EDPB and the EDPS support the goal of streamlining cooperation between fundamental rights authorities or bodies (‘FRABs’) and market surveillance authorities (‘MSAs’). They welcome the idea of a central point of contact to increase efficiency, but recommend: - clarifying the role of the MSAs as administrative points of contact for the execution and transmission of requests to providers and deployers; - ensuring that the proposed change does not affect the independence and powers of DPAs; - adding details to the Proposal, such as requiring MSAs to provide the information requested by FRABs without undue delay; - further clarifying the new obligation for cooperation and mutual assistance between MSAs and FRABs, particularly for cross-border cases. AI literacy The EDPB and the EDPS consider that AI systems providers and deployers should not be released from their obligation to ensure that their staff have a sufficient level of AI literacy, as it helps raising ethical and social awareness on AI benefits and risks. If the co-legislators decide to maintain the new obligation for the Commission and Member States to foster AI literacy, it should apply in addition to the current obligation applying to AI systems providers and deployers, instead of replacing it. Implementation timeline of high-risk rules With regard to the implementation timeline of high-risk rules and the proposed postponement of a number of core provisions, the EDPB and the EDPS acknowledge that some of the reasons for the delay of the application might be deemed at least partially objective, however they express concerns about the potential impact on the protection of fundamental rights in the fast-evolving AI landscape. In this regard, the Joint Opinion invites the co-legislators to consider whether it would be appropriate and feasible to maintain the current timeline for certain obligations, e.g. on transparency. In case the proposed delay of the timeline for entry into application is nevertheless adopted by the co-legislators, the EDPB and the EDPS call for concerted actions by all relevant stakeholders, and in particular by the Commission, in order to minimise the delay to the extent possible. 5 Adopted The European Data Protection Board and the European Data Protection Supervisor Having regard to Article 42(2) of the Regulation 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC. HAVE ADOPTED THE FOLLOWING JOINT OPINION (the ‘Opinion’) 1 BACKGROUND 1. On 19 November 2025, the European Commission (‘the Commission’) issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (‘the Proposal’). On 25 November 2025, the Commission formally consulted the EDPB and the EDPS in accordance with Article 42(2) of Regulation (EU) 2018/1725 (‘EUDPR’) 1 . 2. The Proposal aims to amend Regulation 2024/1689 2 (the ‘AI Act’ or ‘AIA’) to address certain implementation challenges by way of targeted simplification measures. The proposed amendments relate to various topics, ranging from the implementation timeline of the rules for high-risk AI systems, to reducing the registration burden for certain AI systems and extending regulatory simplifications granted to small and medium-sized enterprises (‘SMEs’) to small mid-caps (‘SMCs’) 3 . 3. The aim of this Joint Opinion is not to provide an assessment of all the proposed amendments, but instead, to address the most relevant aspects of the Proposal which are of particular importance for the protection of individuals’ rights and freedoms with regard to the processing of personal data. 1 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L 295, 21.11.2018, pages 39–98. 2 Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act), OJ L, 2024/1689, 12.7.2024. 3 Recital 3 Proposal. Also see COM(2025) 836 final, p.2, in the Explanatory Memorandum accompanying the Proposal. 6 Adopted 2 GENERAL REMARKS 4. The EDPB and the EDPS support the Proposal’s general objective to address certain implementation challenges of the AI Act, with a view to the effective application of the relevant rules. In the same spirit, the EDPB and the EDPS recall that the EDPB and the European Commission are working on joint guidelines on the interplay between the GDPR and the AI Act to be issued later this year. This echoes the commitments of the EDPB in its Helsinki Statement to take up initiatives to facilitate GDPR compliance and strengthen consistency, in order to empower responsible innovation and reinforce competitiveness in Europe 4 . 5. Another aim of the Proposal is to significantly reduce the administrative burden for businesses, national administrations, and the public at large 5 . The EDPB and the EDPS support this general objective of the Proposal, as long as pursuing this objective does not result in lowering the protection of fundamental rights of individuals, in particular the fundamental right to protection of personal data. The EDPB and the EDPS also wish to recall that, already during the initial drafting of the AI Act, several amendments were introduced to help reduce administrative burdens while still protecting the fundamental rights of individuals 6 . A careful balance needs to be kept between reducing administrative burden where possible, without undermining the protection of fundamental rights in the context of AI. Therefore, the EDPB and the EDPS warn against reducing the existing protection offered under the AI Act without careful consideration of the protection of the rights of individuals. In the remainder of this Joint Opinion, the EDPB and the EDPS highlight specific aspects of the Proposal that warrant further consideration and provide specific recommendations to help ensure that the final text of the Proposal maintains a high level of protection of the fundamental rights of individuals, and with a view of providing greater legal certainty for all actors involved. 6. The references to Data Protection Authorities (‘DPAs’) in this Joint Opinion should be understood as the supervisory authorities within the meaning of Article 4(21) GDPR and Article 3(15) Law Enforcement Directive (‘LED’) 7 , regardless of whether they have been entrusted with additional tasks or powers under the AI Act, as market surveillance authorities (‘MSAs’). 3 PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA FOR BIAS DETECTION AND CORRECTION 7. According to Article 10(5) AI Act, providers of high-risk systems may exceptionally process special categories of personal data to the extent that it is strictly necessary for the purpose of ensuring bias detection and correction in accordance with the requirements of Article 10(2)(f) and (g) AI Act. Such processing must be subject to appropriate safeguards for the fundamental rights and freedoms of natural persons. 4 EDPB’s Helsinki Statement on enhanced clarity, support and engagement, A fundamental rights approach to innovation and competitiveness, adopted on 2 July 2025. 5 COM(2025) 836 final, p. 6. 6 For example, Article 6(3) AI Act already provides a derogation for AI systems that do not pose a significant risk to the health, safety or fundamental rights. 7 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, pp. 89–131. 7 Adopted 8. The Proposal would introduce a new Article 4a, replacing Article 10(5), that would allow, where necessary, processing of special categories of personal data by providers and deployers of all AI systems and models, subject to appropriate safeguards as specified in the draft Proposal that complement the GDPR, EUDPR and LED, as applicable. Thus, the Proposal would extend the material and personal scope of Article 10(5) AI Act to all AI systems and models and would also cover deployers. 9. While the processing of special categories of personal data for bias detection and correction can entail additional risks to the fundamental rights and freedoms of the affected data subjects, it is also true that if bias detection and correction are unsuccessful or insufficient, bias in AI systems may present a wider risk to those whose personal data would be processed by the AI system after it has been put on the market, and even to society as a whole. 10. The EDPB and the EDPS also understand that the list of high-risk AI systems can never be exhaustive in referencing all possible AI systems that present substantial risks to the rights and freedoms of individuals. Consequently, systems that have not been identified as high-risk could still lead, in certain cases, to negative consequences for individuals. 11. At the same time, the EDPB and the EDPS recall that processing special categories of personal data is in principle prohibited under EU data protection law and the exceptions to this prohibition should be narrowly defined. To avoid potential abuse, the cases where providers and deployers would be able to rely on this legal ground in the context of non-high risk AI systems and models should be clearly circumscribed and limited to cases where the risk of adverse effects caused by such bias is sufficiently serious to justify the processing of special categories of personal data. 12. The current text of Article 10(5) AI Act refers to processing of special categories of personal data that is ‘strictly necessary’ to detect and correct biases. The proposed new provision of Article 4a(1) refers only to ‘necessary’, while the new Article 4a(2) refers to ‘necessary and proportionate’. The EDPB and the EDPS recommend (re)instating the standard of strict necessity, which currently applies for high-risk AI systems, for all providers and deployers of AI systems and models referred in Article 4a, for the processing of special categories of personal data for the purpose of ensuring bias detection and correction. 13. Current Article 10(5) AI Act limits the possibility to process special categories of personal data to cases where it is necessary to comply with the obligations under Article 10(2)(f) and (g) AI Act. The EDPB and the EDPS stress that the scope of the new Article 4a(2) should be understood as similarly limited to the detection, prevention and mitigation of biases that are likely to affect the health and safety of persons, have a negative impact on fundamental rights or lead to discrimination prohibited under Union law, as provided for by the current Article 10(2)(f) and (g) AI Act, and as already referred to in paragraph 1 of the proposed Article 4a 8 . However, currently, neither the Proposal, nor the Staff Working Document 9 accompanying it, provide any specific guidance or examples. 8 In this regard, the EDPB and the EDPS consider it of utmost importance in order to avoid potential inconsistencies and confusion as to the scope of the derogation and the requirements for the providers and deployers of non-high-risk AI systems or models, and to ensure that the scope of Article 4a remains clearly circumscribed. 9 Commission Staff Working Document accompanying the documents Proposal for a Regulation of the European Parliament and the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus), amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), COM(2025) 837 final, COM(2025) 836 final, SWD/2025/836 final, 19.11.2025. 8 Adopted 14. The EDPB and the EDPS recommend providing, by way of a recital, more detailed justifications for the envisaged extension of the scope of the exception by indicating specific examples of non-high-risk AI systems or models that could adversely affect individuals based on protected characteristics that would warrant processing of special categories of data to counter such bias. 15. The wording used in Article 4a(2) Proposal should also be revised to enhance legal certainty as regards the application of Articles 6 and 9 GDPR which require a clear legal basis and derogation for the processing of special categories of personal data. In this regard, the EDPB and the EDPS note that the wording used in Article 4a(2), in particular the use of ‘may’, is likely to give rise to legal uncertainty. If it is the intention of the co-legislators to extend the duty under current Article 10(2)(f) and (g) AI Act (and the corresponding derogation under Article 9 GDPR 10 ) to providers and deployers of all AI systems and models, this should be clearly stated 11 . 16. Finally, the EDPB and the EDPS recall that, as explained in Recital 70 AI Act, the current provision of Article 10(5) AI Act and thus the new Article 4a, regulate a specific case of processing of special categories of personal data as a matter of substantial public interest within the meaning of Article 9(2)(g) GDPR and Article 10(2)(g) EUDPR. Consequently, all the conditions laid down in the GDPR and the EUDPR would fully apply whenever a developer or a deployer relies on this legal ground. Moreover, the Commission explicitly clarifies that the aim of the amendment is ‘facilitating compliance with the data protection laws’ by providers and deployers of AI systems 12 . Against this background, the EDPB and the EDPS stress that DPAs would first and foremost be competent to supervise the processing of personal data pursuant to Article 4a AIA, also in line with Article 2(7) AIA. 4 REGISTRATION AND DOCUMENTATION 17. The EDPB and the EDPS support the general aim of the Proposal to ease administrative burdens for operators. However, the EDPB and the EDPS recommend maintaining the obligation for providers to register AI systems in the EU database for high-risk systems also in the cases where the provider has concluded the system is - despite being referred to in Annex III AI Act - not high-risk, under the conditions set by Article 6(3) AIA 13 . 18. The registration obligation, as envisaged by the current text of the AIA 14 , ensures the transparency and traceability of these systems towards the public as well as the national competent authorities 15 . Given that the AI systems in question could still pose potentially significant risks, the registration obligation does not seem unreasonable or disproportionate. The proposed deletion of the existing obligation 16 would significantly decrease the accountability of providers of AI systems and would provide an undesirable incentive for providers to unduly invoke this exemption without critical analysis. 10 See Recital 70 AI Act. 11 If that is the case, the EDPB and the EDPS further recommend replacing the wording ‘paragraph 1 may apply’ by ‘paragraph 1 shall also apply’. In addition, the EDPB and the EDPS recommend replacing the wording ‘if the processing occurs’ by ‘where such processing occurs’. 12 COM(2025) 836 final, p.2, see the Explanatory Memorandum accompanying the Proposal. 13 Article 6(3) and Recital 53 AIA. 14 Articles 6(3) and 49(2) AIA; Section B in Annex VIII AIA (points 6 and 7). 15 See Recital 131 AIA. 16 Article 1(6) Proposal (modifying Article 6(4) AIA), Article 1(14) Proposal (deleting Article 49(2) AIA) and Article 1(32) Proposal (deleting Section B in Annex VIII AIA). 9 Adopted 19. First, the registration obligation allows the public to be informed about the grounds under which the provider considers that the AI system ‘does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons’ 17 , despite it being referred to in Annex III AI Act. The public registration further allows deployers to carry out proper due diligence (before deciding whether to make use of the exempted AI system) and risk-management of these AI systems (in the context of the deployment of the AI system). The public disclosure of the assessment conducted by providers that is mandated by the current text, and the related possible reputational risks for providers, are better aligned with the possible risks posed by these AI systems. 20. Second, such registration also serves the purpose of informing national competent authorities and national public authorities or bodies which supervise or enforce the respect of obligations under Union law protecting fundamental rights (‘FRABs’) before these systems are placed in the market or put into service 18 , which in turns may lead them to requesting the documentation and possibly engaging in enforcement activities where appropriate 19 . The registration obligation enables a timely response by national competent authorities and FRABs to mitigate risks. Moreover, the leeway afforded to providers of high-risk AI systems does not appear to be justified by the negligible savings that would arise from this proposed modification 20 . 21. While providers would still be obliged to document their assessment that the AI system referred to in Annex III AIA is not high-risk before that system is placed on the market or put into service, and to make the documentation available to the national competent authorities upon request 21 , this does not appear to be sufficient if not accompanied by the registration. The exemption foreseen by Article 6(3) and 6(4) AIA must remain counter-balanced by appropriate accountability, also considering the existing differing interpretations of the relevant provisions and risks of incorrect assessment 22 . 22. Finally, the EDPB and the EDPS note that the Proposal extends certain regulatory privileges to SMEs and SMCs, defined on the basis of staff headcount and turnover or balance sheet numbers 23 . 23. In this regard, it should be recalled that, in light of AI’s features of scalability and autonomy, the headcount and more generally the company size may not be a decisive factor to assess the possible harm posed by high-risk AI systems placed on the market by such enterprises. 24. As a consequence, the EDPB and the EDPS express concerns as to the approach of simplifying the obligations relating to product safety of AI systems on the basis of the size of the company and especially headcount. 17 Article 6(3) AIA. 18 See Article 6(4) AIA. 19 See Article 80 AIA. 20 According to the documents supporting the Proposal, this change would benefit a maximum of 1485 companies, saving each EUR 100, thus providing for total savings up to EUR 148,500 per year. Commission Staff Working Document accompanying the Proposal for a Regulation of The European Parliament and of the Council Amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus) and the Proposal for a Regulation of the European Parliament and of the Council Amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), SWD/2025/836 final, p. 78. 21 Article 6(4) AIA. See also Recital 53 AIA. 22 Fundamental Rights Agency (FRA): “Assessing High-risk Artificial Intelligence: Fundamental Rights Risk”, 2025, p. 8, 28. 23 More specifically, the Proposal extends certain regulatory privileges to SMEs and SMCs, relating to simplified technical documentation (Article 1(8) Proposal), proportionate implementation of quality management systems (QMS) (Article 1(9) Proposal), complying with certain elements of the QMS in a simplified manner (SME only) (Article 1(21) Proposal), the facilitation and acceleration of access to the sandbox (Article 1(17) Proposal) and specific support from authorities, Member States or the Commission (e.g. Article 1(23), (27), (28) Proposal)). 10 Adopted 5 AI REGULATORY SANDBOXES AT UNION LEVEL 25. The EDPB and the EDPS welcome the introduction of AI regulatory sandboxes at EU level, to support innovation and SMEs across the EEA (new Article 57(3a) AIA). The proposed changes to Articles 57 and 58 AIA introduce the possibility for the AI Office to establish such sandboxes with regard to certain AI systems, such as those based on a general-purpose AI model (subject to the specifications provided under Article 1(25), para.1, Proposal) 24 . These sandboxes would be established in addition to those at national level that should be established on the basis of Article 57 AIA 25 . 26. With respect to national sandboxes, Article 57(10) AIA currently requires national competent authorities to ensure that, to the extent the AI systems involve personal data processing, the national DPAs are associated with the operation of the national sandbox and involved in the supervision of those aspects to the extent of their respective tasks and powers. There is no similar provision in relation to EU-level sandboxes, even though they may involve processing of personal data which is subject to the oversight of DPAs. The EDPB and the EDPS recommend clarifying, directly in the AI Act, that competent DPAs should be associated with the operation of EU-level sandboxes and involved in the supervision and enforcement of the corresponding data processing 26 in line with Articles 55 et seq. GDPR. 27. Further, it is unclear how the competent DPA would be identified in the context of EU-level sandboxes and how this relates to the cooperation mechanism under the GDPR. The amended Article 58(1)(d) AIA requires the Commission to address, in an implementing act, ‘common principles’ on ‘the detailed rules applicable to the governance of AI regulatory sandboxes covered under Article 57, including as regards the exercise of the tasks of the competent authorities and the coordination and cooperation at national and EU level’. Since association to a sandbox involves significant limitations to the powers of the competent DPAs 27 , the issue of the competence of DPAs and its interplay with the GDPR cooperation mechanism should be addressed directly in the AI Act to avoid any legal uncertainty. 28. In addition, the EDPB and the EDPS consider that the EDPB should be involved in order to ensure a coordinated and consistent approach 28 . To that end, the EDPB and the EDPS recommend modifying Article 57 AIA to specifically refer to the advisory role of the EDPB for ensuring consistency on data protection aspects, specifically in cases where several DPAs would be concerned by the AI system developed in the EU-level AI sandbox pursuant to Article 57(3a) AIA. 24 See in particular Articles 57 and 58 AI Act. These systems are those identified under Article 1(25), para. 1, Proposal (modifying Article 75(1) AI Act), which establishes that “ Where an AI system is based on a general-purpose AI model, with the exclusion of AI systems related to products covered by the Union harmonisation legislation listed in Annex I, and that model and that system are developed by the same provider, the AI Office shall be exclusively competent for the supervision and enforcement of that system with the obligations of this Regulation in accordance with the tasks and responsibilities assigned by it to market surveillance authorities. The AI Office shall also be exclusively competent for the supervision and enforcement of the obligations under this Regulation in relation to AI system that constitute or that are integrated into a designated very large online platform or very large online search engine within the meaning of Regulation (EU) 2022/2065 .” 25 Based on Article 57(2) and (3) AIA, AI regulatory sandboxes at regional or local level may also be established by competent authorities, as well as AI regulatory sandbox for Union institutions, bodies, offices and agencies which may be established by the EDPS. 26 The EDPB and the EDPS note that if a national DPA is actively involved in the supervision of the AI system in the sandbox and provided guidance for compliance with respect to the GDPR, no administrative fines can be imposed under the GDPR, pursuant to Article 57(12) AI Act. 27 As per Article 57(12) AI Act. 28 As per Article 70(1) GDPR, the EDPB’s mission is to ensure the consistent application of the GDPR . 11 Adopted 29. Additionally, the EDPB should be granted, directly in the AI Act, the status of observer at the European Artificial Intelligence Board (‘AI Board’) 29 . This could ensure the continuous involvement of the EDPB when matters related to the application of data protection law, such as in the context of EU-level sandboxes 30 , are discussed within the AI Board. 30. The new obligation of national competent authorities to support the joint establishment and operation of AI regulatory sandboxes in the revised Article 57(14) AIA is welcomed by the EDPB and the EDPS. This new obligation, which does not affect the possibility of additional sandboxes according to Article 57(2) AIA, and could ensure coordinated cross-border approaches among authorities. However, how such obligation will be operationalised in practice remains unclear, hence the EDPB and the EDPS recommend clarifying these aspects. 31. Lastly, a clear distinction should be made between AI sandboxes for Union institutions, bodies, offices or agencies, which may be established by the EDPS pursuant to Article 57(3) AIA, and the EU-level AI sandbox established by the AI Office pursuant to Article 57(3a) AIA, which would in any event remain limited to AI systems covered by Article 75(1) AIA. In line with Recital 14 Proposal (see also Section 6 of the Joint Opinion below), the EDPB and the EDPS understand that AI systems placed on the market, put into service or used by Union institutions, bodies, offices or agencies would not be involved in the AI regulatory sandbox at EU-level within the meaning of Article 57(3a) AIA, as the EDPS is the sole competent authority under the AI Act for such AI systems, pursuant to Article 74(9) AIA. Moreover, the EDPB and the EDPS recall that the EDPS remains the competent authority under Regulation (EU) 2018/1725 to supervise any processing of personal data by the AI Office itself, as EU body, including in the context of EU-level sandboxes. 6 SUPERVISION AND ENFORCEMENT BY THE AI OFFICE 32. Pursuant to Article 75 AI Act, the AI Office is competent to monitor and supervise compliance of AI systems based on a general-purpose AI model, when the model and the system are developed by the same provider. The Proposal further extends this exclusive competence to AI systems that constitute or are integrated into a designated very large online platform (‘VLOP’) or very large online search engine (‘VLOSE’) within the meaning of Regulation (EU) 2022/2065 (‘DSA’) 31 . 29 This status is for example already granted to the EDPS in Article 65(1) AI Act, which is the supervisor for the EU institutions. 30 According to Article 57(14) AIA, as modified by Article 1(17) Proposal, coordination and cooperation on sandboxes should be done within the AI Board. 31 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act), OJ L 277, 27.10.2022, p. 1. 12 Adopted 33. The EDPB and the EDPS acknowledge that the monitoring, supervision, and enforcement of such systems would benefit from centralising competencies at the EU level. In this regard, they welcome the fact that Article 75(1), last subparagraph AIA, requires active cooperation between the authorities involved in the application of AI Act in the exercise of these powers. However, the EDPB and the EDPS consider this active cooperation provision may not be sufficient to guarantee the ability of national competent authorities to initiate actions if the AI Office has not already acted or does not want to, given the exclusivity of the authority granted to the AI Office. Finally, the AI Office should coordinate closely with the competent national data protection authorities when the aforementioned AI systems present risks to the fundamental rights to privacy and data protection, in compliance with Article 8(3) of the Charter of Fundamental Rights of the EU and in line with Article 2(7) AIA. Moreover, the EDPB and the EDPS recommend to clearly delimitate the types of general-purpose AI models that trigger ’exclusive competence’ to ensure effective supervision of AI systems. 34. In addition, the EDPB and the EDPS positively note that Recital 14 Proposal clarifies that the AI Office would not be competent for AI systems placed on the market, put into service or used by Union institutions, bodies, offices or agencies, which are under the supervision of the EDPS pursuant to Article 74(9) AI Act. However, this clarification is not provided in the operative part of the draft Regulation. Therefore, in the interest of legal certainty, as well as to ensure the necessary independent character of the supervision by the competent authority, the EDPB and the EDPS consider it necessary that, in addition to Recital 14, the amended Article 75 should expressly exclude from the competence of the AI Office the supervision of AI systems developed or used by Union institutions, bodies, offices or agencies and covered by Article 74(9) AI Act. 7 POWERS OF AUTHORITIES/BODIES PROTECTING FUNDAMENTAL RIGHTS AND COOPERATION WITH MSA 35. The EDPB and the EDPS support the general objective of clarifying the scope of the cooperation between market surveillance authorities (‘MSAs’) and FRABs. This is also in line with the EDPB’s recommendations included in its Statement 3/2024 on data protection authorities’ role in the AIA 32 . 36. Article 77 AIA currently allows FRABs to directly request documentation produced for the purpose of AIA compliance to deployers or providers, and the proposed change would, in practice, place the MSAs as an intermediary between the FRABs on one side, and the deployers or providers on the other. The establishment of a centralised point of contact with the objective of increasing efficiency is welcomed by the EDPB and the EDPS as this would reduce the administrative burden for companies. However, the EDPB and the EDPS note that, requiring FRABs to obtain information or documentation produced for the purpose of AIA compliance from providers or deployers solely through MSAs may actually result in inefficiencies. Therefore, they recommend ensuring that the establishment of a centralised point of contact achieves, in practice, the objective of making the procedure more efficient. 32 EDPB Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework, adopted on 16 July 2024, paragraphs 11, 13 and 15. 13 Adopted 37. The EDPB and the EDPS recommend further clarifying the competence and the role of MSAs under Article 77 AIA. In this regard, the EDPB and the EDPS consider it important to explicitly clarify that the role of MSAs should be strictly that of an administrative point of contact for the execution and transmission of requests of information or documentation to providers and deployers, and should not lead to MSAs assessing the necessity or proportionality of the request. 38. Moreover, the Proposal should clarify that it does not affect the independence and existing powers of DPAs, in particular, the powers of DPAs to obtain, from the controller and the processor, access to all information necessary for the purpose of monitoring compliance with data protection law 33 . 39. Article 77(1a) AIA, added by the Proposal, should be more specific in order to build a workable information exchange system in case of cross-border cooperation 34 . In addition, the Proposal should specify that MSAs should provide the information requested by FRABs without undue delay, where the information is exchanged at national level, and also in cross-border cases. These additional elements would ensure legal certainty and smooth cooperation between the relevant authorities. 40. Should the proposed changes to Article 6(4) AIA (registration obligation for providers of AI systems, see Section 4 of the Joint Opinion) be maintained in spite of the opinion of the EDPB and the EDPS on this matter, the clarifications mentioned above would all the more be beneficial as these latter changes would reduce the information publicly available. 41. Lastly, the EDPB and the EDPS positively note the addition of Article 77(1b) AIA, which creates a new obligation of cooperation and mutual assistance between MSAs and FRABs. This proposed addition could be beneficial in case of cross-border cooperation 35 (e.g. in case one FRAB sends a request to an MSA, which needs the assistance of an MSA from another Member State 36 to answer it), provided that it aligns with the principle of sincere cooperation provided by Article 4(3) of the TEU. This new obligation could be further completed by clarifying how this mutual assistance under the added Article 77(1b) AIA interplays, for AI systems, with the cross-border mutual assistance for market surveillance and compliance of products 37 under Regulation (EU) 2019/1020 and Article 75 AIA. 8 AI LITERACY 42. The EDPB and the EDPS recommend maintaining the obligation, for providers and deployers of AI systems, to take measures to ensure a sufficient level of AI literacy of their staff and other relevant persons (Article 4 AIA). 33 Article 58(1)(e) GDPR and Art. 47(1) LED. See also Recital 157 of the current AIA. 34 An example of an elaborate procedure for information exchange in case of cross-border cooperation is for example Article 61 GDPR. 35 Judgment of 4 July 2023, Bundeskartellamt , C-252/21, EU:C:2023:537, paragraphs 54, 58 and 63. 36 Or needs assistance from the AI Office in the circumstances addressed in Article 75(3) AIA. 37 See Chapter VI of Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019 on market surveillance and compliance of products and amending Directive 2004/42/EC and Regulations (EC) No 765/2008 and (EU) No 305/2011. 14 Adopted 43. AI literacy ensures an understanding of AI concepts and helps raising ethical and social awareness about the benefits and risks of AI. It plays a key role in empowering individuals that develop, deploy, or otherwise work or decide on working with AI systems and allows them to develop critical thinking with regard to this new technology and inform their decision-making. AI literacy is therefore crucial to ensure appropriate knowledge and skills across the AI life- cycle in order to protect fundamental rights, including the right to data protection, and support compliance with AI rules, including the provisions on processing of personal data. 44. Transforming the current obligation into an obligation for the European Commission and the Member States to ‘encourage’ providers and deployers to do so would significantly soften this obligation and ultimately undermine its very objective. 45. To help providers and deployers comply with their AI-literacy obligation, the European Commission and regulators could be required to issue guidance on how this obligation may be implemented in practice, instead of removing the AI literacy requirement on providers and deployers. 46. Lastly, if the new obligation for the European Commission and Member States to ‘encourage’ providers and deployers to take measures to ensure a sufficient AI literacy would be kept, it should apply in parallel with the current obligation in Article 4 AI Act, as opposed to replacing it. 9 IMPLEMENTATION TIMELINE OF HIGH-RISK RULES 47. Under the current Article 113 AI Act, the provisions governing high-risk AI systems included in Annex III 38 will start to apply from 2 August 2026. For high-risk AI systems under Annex I 39 , the starting date is 2 August 2027. 48. Pursuant to the Proposal, the rules on high-risk AI systems should start to apply 6 or 12 months following the decision of the Commission confirming that adequate measures in support of compliance with Chapter III are available, but not later than 2 December 2027 for high-risk AI systems in Annex III, and 2 August 2028 as regards high-risk AI systems in Annex I. The Commission justifies the proposed delay with implementation challenges such as delays in designating national competent authorities and conformity assessment bodies, as well as a lack of harmonised standards for the AI Act’s high-risk requirements, guidance, and compliance tools. 49. The proposed postponement of the application of a number of core provisions of AI Act should also be considered in the context of the extension of the temporal scope of the existing ‘grandfathering clause’ of Article 111(2) AI Act, pursuant to which high-risk AI systems already placed in the EU market would largely be excluded from the scope of the Act unless they are subject to significant changes in their design. According to the Proposal, the cut-off date would be changed from 2 August 2026 to 2 December 2027, thus allowing an increased number of high-risk AI systems to benefit from the exception as ‘legacy’ systems. 38 High-risk AI systems in the areas of, among others, biometrics, law enforcement, migration, asylum and border control management, education, employment, judiciary, etc. 39 High-risk AI systems covered by Union harmonisation legislation, related, among others, to civil aviation, medical devices, toys, etc. 15 Adopted 50. While the EDPB and the EDPS acknowledge that some of the reasons for the delay of the application might be deemed at least partially objective and not fully under the control of the Commission, they are nevertheless sincerely concerned about the potential impact on the protection of fundamental rights in the fast-evolving and transformative AI landscape. In addition, it should be assessed whether the introduction of a moveable deadline would not also undermine legal certainty. The EDPB and the EDPS also recall that, in their Joint Opinion 5/2021 on the proposal for Artificial Intelligence Act, they had already objected to the exemption from the obligations of AI systems already placed on the market 40 . 51. Furthermore, given the different nature of the obligations for providers and deployers of high- risk AI systems laid down in Chapter III, Sections 1, 2, and 3 AI Act, the EDPB and the EDPS invite the co-legislators to consider whether it would be appropriate and feasible to maintain the current timeline for certain obligations, e.g. on transparency. 52. Finally, if the proposed delay of the timeline for entry into application is nevertheless adopted by the co-legislators, the EDPB and the EDPS call for concerted actions by all relevant stakeholders, and in particular by the Commission, in order to minimise the delay to the extent possible. 40 EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence, adopted on 18 June 2021, para. 41.

## Cited law provisions (31)

### GDPR — gdpr-art-6-par-3-nl

De rechtsgrond voor de in lid 1, punten c) en e), bedoelde verwerking moet worden vastgesteld bij:

### GDPR — gdpr-art-6-par-4-nl

Wanneer de verwerking voor een ander doel dan dat waarvoor de persoonsgegevens zijn verzameld niet berust op toestemming van de betrokkene of op een Unierechtelijke bepaling of een lidstaatrechtelijke bepaling die in een democratische samenleving een noodzakelijke en evenredige maatregel vormt ter waarborging van de in artikel 23, lid 1, bedoelde doelstellingen houdt de verwerkingsverantwoordelijke bij de beoordeling van de vraag of de verwerking voor een ander doel verenigbaar is met het doel waarvoor de persoonsgegevens aanvankelijk zijn verzameld onder meer rekening met:

### GDPR — gdpr-art-8-par-3-nl

Lid 1 laat het algemene overeenkomstenrecht van de lidstaten, zoals de regels inzake de geldigheid, de totstandkoming of de gevolgen van overeenkomsten ten opzichte van kinderen, onverlet.

### GDPR — gdpr-art-9-par-2-nl

Lid 1 is niet van toepassing wanneer aan een van de onderstaande voorwaarden is voldaan:

### GDPR — gdpr-art-42-par-2-nl

Ter aanvulling op de naleving door verwerkingsverantwoordelijken of verwerkers die onder deze verordening vallen, kunnen tevens uit hoofde van lid 5 van dit artikel goedgekeurde certificeringsmechanismen voor gegevensbescherming, gegevensbeschermingszegels of -merktekens worden ingevoerd om aan te tonen dat de verwerkingsverantwoordelijken of verwerkers die overeenkomstig artikel 3 niet onder deze verordening vallen, in het kader van de doorgiften van persoonsgegevens aan derde landen of internationale organisaties onder de voorwaarden als bedoeld in artikel 46, lid 2, punt f), passende waarborgen bieden. Die verwerkingsverantwoordelijken of verwerkers doen, via contractuele of andere juridisch bindende instrumenten, bindende en afdwingbare toezeggingen om die passende waarborgen toe te passen, ook wat betreft de rechten van de betrokkenen.

### GDPR — gdpr-art-47-par-1-nl

De bevoegde toezichthoudende autoriteit keurt in overeenstemming met het in artikel 63 bedoelde coherentiemechanism bindende bedrijfsvoorschriften goed, op voorwaarde dat deze:

### GDPR — gdpr-art-49-par-2-nl

Een doorgifte overeenkomstig lid 1, eerste alinea, onder g), mag geen betrekking hebben op alle persoonsgegevens of volledige categorieën van persoonsgegevens die in het register zijn opgeslagen. Wanneer een register bedoeld is om door personen met een gerechtvaardigd belang te worden geraadpleegd, kan de doorgifte slechts plaatsvinden op verzoek van die personen of wanneer de gegevens voor hen zijn bestemd.

### GDPR — gdpr-art-57-par-2-nl

Elke toezichthoudende autoriteit faciliteert de indiening van klachten als bedoeld in lid 1, onder f), door maatregelen te nemen, zoals het ter beschikking stellen van een klachtenformulier dat ook elektronisch kan worden ingevuld, zonder dat andere communicatiemiddelen worden uitgesloten.

### GDPR — gdpr-art-57-par-3-nl

Elke toezichthoudende autoriteit verricht haar taken kosteloos voor de betrokkene en, in voorkomend geval, voor de functionaris voor gegevensbescherming.

### GDPR — gdpr-art-58-par-1-nl

Elk toezichthoudende autoriteit heeft alle volgende onderzoeksbevoegdheden om:

### GDPR — gdpr-art-65-par-1-nl

Om te zorgen voor de correcte en consequente toepassing van deze verordening in individuele gevallen, stelt het Comité een bindend besluit vast in de volgende gevallen:

### GDPR — gdpr-art-70-par-1-nl

Het Comité zorgt ervoor dat deze verordening consequent wordt toegepast. Daartoe doet het Comité op eigen initiatief of, waar passend, op verzoek van de Commissie met name het volgende:

### GDPR — gdpr-art-75-par-1-nl

Het Comité heeft een secretariaat, dat wordt verzorgd door de Europese Toezichthouder voor gegevensbescherming.

### GDPR — gdpr-art-75-par-3-nl

De personeelsleden van de Europese Toezichthouder voor gegevensbescherming die betrokken zijn bij de uitvoering van de krachtens deze verordening aan het Comité opgedragen taken vallen onder een andere rapportageregeling dan de personeelsleden die betrokken zijn bij de uitvoering van de aan de Europese Toezichthouder voor gegevensbescherming opgedragen taken.

### GDPR — gdpr-art-1-nl

Onderwerp en doelstellingen

### GDPR — gdpr-art-2-nl

Materieel toepassingsgebied

### GDPR — gdpr-art-3-nl

Territoriaal toepassingsgebied

### GDPR — gdpr-art-4-nl

Voor de toepassing van deze verordening wordt verstaan onder:

### GDPR — gdpr-art-9-nl

Verwerking van bijzondere categorieën van persoonsgegevens

### GDPR — gdpr-art-10-nl

Persoonsgegevens betreffende strafrechtelijke veroordelingen en strafbare feiten of daarmee verband houdende veiligheidsmaatregelen mogen op grond van artikel 6, lid 1, alleen worden verwerkt onder toezicht van de overheid of indien de verwerking is toegestaan bij Unierechtelijke of lidstaatrechtelijke bepalingen die passende waarborgen voor de rechten en vrijheden van de betrokkenen bieden. Omvattende registers van strafrechtelijke veroordelingen mogen alleen worden bijgehouden onder toezicht van de overheid.

### GDPR — gdpr-art-57-nl

Taken

### GDPR — gdpr-art-61-nl

Wederzijdse bijstand

### GDPR — gdpr-art-74-nl

Taken van de voorzitter

### GDPR — gdpr-art-75-nl

Secretariaat

### GDPR — gdpr-art-77-nl

Recht om klacht in te dienen bij een toezichthoudende autoriteit

### GDPR — gdpr-art-80-nl

Vertegenwoordiging van betrokkenen

### GDPR — gdpr-art-4-par-3-nl

„beperken van de verwerking”: het markeren van opgeslagen persoonsgegevens met als doel de verwerking ervan in de toekomst te beperken;

### GDPR — gdpr-art-4-par-21-nl

„toezichthoudende autoriteit”: een door een lidstaat ingevolge artikel 51 ingestelde onafhankelijke overheidsinstantie;

### GDPR — gdpr-art-9-par-2-pnt-g-nl

de verwerking is noodzakelijk om redenen van zwaarwegend algemeen belang, op grond van Unierecht of lidstatelijk recht, waarbij de evenredigheid met het nagestreefde doel wordt gewaarborgd, de wezenlijke inhoud van het recht op bescherming van persoonsgegevens wordt geëerbiedigd en passende en specifieke maatregelen worden getroffen ter bescherming van de grondrechten en de fundamentele belangen van de betrokkene;

### GDPR — gdpr-art-58-par-1-pnt-d-nl

de verwerkingsverantwoordelijke of de verwerker in kennis te stellen van een beweerde inbreuk op deze verordening;

### GDPR — gdpr-art-58-par-1-pnt-e-nl

van de verwerkingsverantwoordelijke en de verwerker toegang te verkrijgen tot alle persoonsgegevens en alle informatie die noodzakelijk is voor de uitvoering van haar taken; en

---
Generated by overview.legal · https://overview.legal/posts/53738 · 2026-08-22