AI, the European Data Protection Supervisor: “We have the tools to lead the EU”

Brussels – “We cannot eliminate every risk, but our European Data Protection Supervisor (EDPS) has all the tools to guide the EU administration in the use of artificial intelligence.” This was stated by Wojciech Rafal Wiewiórowski, the European Data Protection Supervisor, at a press conference, today (7 May), during which he commented on the EDPS’s annual report, having presented it earlier in the morning to the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE). 

At the heart of it all lies the future of data protection. “In 2024, we decided it was time to take a step forward; now we are making a full contribution to the governance of artificial intelligence,” said Wiewiórowski. The next step is “to encourage institutions to use AI in the right way and in the right context.” 

The provisions on high-risk AI set out in the Artificial Intelligence Act were due to come into force in August. However, the Council and the European Parliament have today reached a temporary agreement to streamline certain rules on this issue. The agreement revises the implementation deadlines and introduces new obligations. Autonomous high-risk AI systems must be compliant by 2 December 2027, while those integrated into products by 2 August 2028. “Obviously, I cannot be happy about the postponement of the deadlines,” commented Data Protection Supervisor Wiewiórowski, “but I recognise that there were genuine changes that needed to be made.” Among these is the explicit ban on using AI to generate non-consensual sexual content or child pornography.

 With the entry into force of the AI Act, the EDPS has become the market supervisory authority for AI systems used by EU institutions. Consequently, “a dedicated AI unit has been established and a regulatory sandbox pilot project has been launched, enabling EU institutions to test AI systems under the guidance of regulatory authorities,” explained the Supervisor. An interesting figure is the number of legislative consultations recorded: 145 in 2025. “This tool,” clarified Wiewiórowski, “enables us to provide expert opinions on key issues such as digital identity or amendments to regulations.” 

“2025 was the year of ‘active governance’,” the Data Protection Supervisor continued, “and that is why we organised a mapping of the use of high-risk AI systems within EU institutions. Thus we realised that EU institutions tend not to develop in-house AI tools and are increasingly dependent on tools already available on the market and on generative AI.”