EDPS Revises Generative AI Guidance for EU Institutions
The European Data Protection Supervisor (EDPS) published updated guidance on the use of generative artificial intelligence by EU institutions, bodies, offices and agencies to reinforce data protection in a fast-changing digital environment. The revised text clarifies the definition of generative AI, reflects technological progress and incorporates feedback from EUIs to make recommendations more practical and easier to apply under Regulation (EU) 2018/1725. It also introduces a new compliance checklist to support consistent implementation across institutions and better protect personal data when generative AI is used.
The updated guidance sets out clearer responsibilities for data controllers and processors within EUIs, detailing steps to ensure lawful processing and to safeguard individuals’ rights. The document addresses issues such as data minimisation, purpose limitation, transparency, and security measures required when training or deploying generative models. It emphasises how contractual arrangements and documentation should demonstrate compliance with data-protection obligations and enable effective oversight.
Wojciech Wiewiórowski, European Data Protection Supervisor, described the revision as both an update and a reaffirmation of the EDPS mission to support innovation while protecting personal data. He highlighted that the guidance aims to provide practical, hands-on advice so that generative AI tools used by EUIs serve the public interest without undermining European data protection standards. The EDPS underlines its role as the independent data protection authority for EU institutions and clarifies that the guidance does not constitute market surveillance under the EU Artificial Intelligence Act.
The EDPS signalled an ongoing commitment to monitoring technological developments and to updating its recommendations as new risks and use cases emerge. EUIs are encouraged to follow the new checklist and to engage proactively with the EDPS when deploying generative AI solutions. The guidance provides a solid baseline for accountability and risk management while leaving room for future refinement as AI capabilities and regulatory frameworks evolve.
