The role of the European Data Protection Supervisor under the AI Act: institutional transformation, regulatory challenges, and first lessons learned

• Sonia Perez Romero
• Rossella Andronico

Regulation (EU) 2024/1689 (AI Act) has designated the European Data Protection Supervisor as Market Surveillance Authority (MSA) for AI systems put into service or used by European Union institutions, bodies, offices and agencies (EUIs) and as a Notified Body for certain high-risk AI systems of the EUIs. This article examines the EDPS’s expanded mandate under the AI Act, the relevant legal framework and contextual challenges, alongside the EDPS’s proactive approach to its role and its initial implementation initiatives.