TLDR: The European Data Protection Supervisor (EDPS) has issued revised guidelines for EU institutions, bodies, offices, and agencies (EUIs) on the use of generative Artificial Intelligence (AI). These updated guidelines aim to strengthen data protection measures, provide clearer definitions, introduce a compliance checklist, and offer practical advice on lawful processing and accountability in the rapidly evolving AI landscape. The EDPS emphasizes its commitment to human-centric innovation while rigorously safeguarding personal data.
Brussels, Belgium – October 28, 2025 – The European Data Protection Supervisor (EDPS) today announced the publication of its revised and updated guidelines concerning the deployment and use of generative Artificial Intelligence (AI) by European Union institutions, bodies, offices, and agencies (EUIs). This significant update reflects the dynamic nature of technological advancements and the increasing complexities associated with generative AI systems.
The new guidance is designed to reinforce the EDPS’s dedication to assisting EUIs in fully adhering to their data protection obligations, as stipulated in Regulation (EU) 2018/1725. It builds upon feedback received from various EUIs, offering more precise and actionable instructions for the responsible development and implementation of generative AI tools.
Key updates introduced in the revised guidelines include:
Refined Definition: A clearer and more consistent definition of generative AI has been provided to enhance understanding and application.
Compliance Checklist: A new, action-oriented checklist has been incorporated to aid EUIs in assessing and ensuring the legality of their data processing activities when using generative AI.
Clarified Roles and Responsibilities: The guidelines offer detailed clarification on roles, helping EUIs determine whether they function as data controllers, joint controllers, or data processors.
Practical Advice: Comprehensive advice is given on establishing lawful bases for processing, adhering to purpose limitation principles, and effectively managing data subjects’ rights within the context of generative AI.
Wojciech Wiewiórowski, the European Data Protection Supervisor, commented on the revision, stating, “Artificial intelligence is an extension of human ingenuity, and the rules governing it must evolve just as dynamically. This first revision of our Orientations is more than an update; it’s a reaffirmation of our dual mission: enabling human-centric innovation within the EU while rigorously safeguarding individual’s personal data. With this new version, we provide hands-on guidance to ensure that any generative AI used by EU institutions serves the public interest without compromising Europe’s data protection standards.”
The EDPS underscores its proactive stance in monitoring technological developments and providing strategic advice to EU institutions on how to seamlessly integrate innovation while upholding privacy and data protection. The Supervisor’s office confirmed its ongoing commitment to tracking the evolution of generative AI and will update its guidance as necessary to address any emerging challenges.
Also Read:
- Generative AI Poised to Deliver €1.2 Billion Annual Boost to Portuguese Public Administration
- Maddocks Provides Expert Guidance on Australia’s Revised AI Adoption Framework
It is important to note that these guidelines are issued by the EDPS in its capacity as the independent data protection supervisory authority for EUIs. They do not pertain to its role as a market surveillance authority under the EU’s Artificial Intelligence Act. The foundational rules for data protection within EU institutions and the responsibilities of the EDPS are established by Regulation (EU) 2018/1725.
