Statement 3/2024 on data protection authorities' role in the Artificial Intelligence Act framework

What it covers

This statement addresses the role that data protection authorities should play under the AI Act enforcement framework following its entry into force, recommending that DPAs be designated as market surveillance authorities for certain high-risk AI systems and highlighting the need for cooperation between market surveillance authorities and data protection authorities.

Why it matters

It records the EDPB's position on how AI Act supervision should be allocated among national authorities and its relationship with existing GDPR enforcement structures, relevant to anyone tracking the institutional interplay between AI regulation and data protection.

Refer to it when

• researching which authority supervises high-risk AI systems in a Member State
• understanding the relationship between DPAs and AI Act market surveillance authorities
• assessing how the AI Act and GDPR enforcement frameworks interact

Questions this document addresses

• Which authorities should be designated as market surveillance authorities under the AI Act?
• Why does the EDPB consider DPAs well placed for this role?
• How should DPAs and market surveillance authorities cooperate?

Topics

• Artificial intelligence
• Supervisory authorities
• Enforcement