EDPS issue final own-initiative opinion on the EU AI Act

The Opinion welcomes the proposal to designate the EDPS as notified body, market surveillance authority and competent authority overseeing the development, provision or use of AI systems by EU institutions, bodies, offices and agencies (EUIs). The EDPS flags particular recommendations regarding those tasks and clarification of powers and the need for resourcing.

Amongst other things the EDPS:

• notes the need to ensure that particular uses of AI systems are prohibited or designated as high risk, as previously called out in the EDPS-EDPB Joint Opinion on the AI Act. For example, amongst others the EDPS consider that AI systems that: carry out social scoring; automatically recognise human features in public spaces (including likes of gait and behavioural signals as well as faces); categorise individuals from biometrics according to ethnicity, gender, political or sexual orientation or other grounds for discrimination; and, subject to specific exceptions, infer emotions; should be prohibited. Caution is urged when it comes to defining the scope of exceptions to the “high-risk” designation so that exceptions (such as that relating to systems where output is accessory to the action/decision, or where the AI system doesn’t pose a significant risk to health, safety or fundamental rights) are not too broadly drawn.
• makes recommendations regarding scope of the AI Act, noting that AI systems currently in use (including AI systems which are components of EU large-scale IT systems) should not be exempt from the AI Act but rather should be required to comply with the requirements once the AI Act applies. Similarly, the AI Act should be clear that it extends to AI operators (as “providers”) that retrain systems (sometimes as part of a continual process), as is particularly relevant to foundation models.
• also recognises the benefit of individual rights and in particular the ability to complain to a competent authority and secure effective judicial remedy. The EDPS reiterated the preference for national data protection authorities to be designated as national supervisory authorities under the AI Act (as certain countries are already anticipating).
• supports the establishment of an EU AI Office but calls for full voting rights and membership of the same so he can effectively contribute on joint investigations. The EDPS also suggests he takes the role as AI Office Secretariat to make the most of his experience fulfilling the same role for the European Data Protection Board.

The press release is available here, and the Opinion here.