EDPB reviews draft guidance on AI Act and EU data-protection law
Key Takeaways
- 01The EDPB discussed draft guidelines on the relationship between the EU AI Act and EU data-protection law at its 17 September 2026 plenary meeting.
- 02The guidance is expected to address AI uses that process personal data and therefore engage both the AI Act and the GDPR.
- 03The EDPB also considered coordination issues between the GDPR and the Digital Services Act.
- 04The draft guidelines were under discussion and do not yet create final obligations.
At its 123rd plenary meeting on 17 September 2026, the European Data Protection Board (EDPB) considered draft guidelines on how the EU AI Act interacts with EU data-protection law, including the General Data Protection Regulation (GDPR).
The work is intended to clarify how the AI Act’s rules apply alongside existing privacy obligations. This is particularly relevant where AI systems process personal data, potentially bringing developers, deployers and other organisations within both regulatory frameworks.
The agenda also included coordination between the GDPR and the Digital Services Act. The discussion signals continued regulatory attention to situations in which online-platform, privacy and AI rules overlap.
The meeting agenda does not establish final requirements. Organisations using or developing AI systems should nevertheless monitor the eventual EDPB guidance, as it may shape supervisory authorities’ expectations for GDPR compliance in AI-related processing.