GDPR · EDPB · IT security
Sources on data protection, supervision, EDPB, cybersecurity and technical security for AI systems.
Article 4a of the EU AI Act allows processing of special categories of personal data for bias detection and correction in AI systems, subject to strict safeguards for fundamental rights, particularly for high-risk AI systems.
Source: European Commission / AI Act Service Desk
The Federal Network Agency provides definitions for the AI Act, including explanations of AI systems, involved actors, and biometric technologies. The document serves as an information source for implementing the EU AI Act.
Source: Bundesnetzagentur
Annex III of the EU AI Act defines criteria for classifying AI systems as high-risk and sets detailed requirements for their development, deployment, and monitoring. It includes 83 specific articles covering risk management, data governance, transparency obligations, and conformity assessment procedures.
Source: European Commission
The Federal Network Agency prepares the implementation of the EU AI Act in Germany. The regulation governs AI systems based on risk, with strict requirements for transparency and safety at high risk levels. Effective from August 2027.
Source: Bundesnetzagentur
The EDPB and EDPS provide joint recommendations on data protection aspects of the European Biotech Act proposal. The proposal aims to strengthen the biotechnology industry while ensuring GDPR compliance in clinical trials and AI use.
Source: European Data Protection Board
The EDPB 2025 Annual Report summarises the activities of the Support Pool of Experts (SPE), including completed projects on AI risks, data protection enforcement, and technological tools. The report highlights transparency and cooperation between supervisory authorities.
Source: European Data Protection Board
The German Federal Office for Information Security (BSI) examines security aspects of artificial intelligence (AI) and develops evaluation criteria. The focus is on robustness, transparency and explainability of AI systems and their application in security-critical areas.
Source: Bundesamt für Sicherheit in der Informationstechnik
The Federal Network Agency presents AI real labs as an innovation tool under the EU AI Act. Real labs allow companies to test AI systems under real conditions and clarify legal issues in advance. A pilot project and the EUSAiR pilot project provide practical insights.
Source: Bundesnetzagentur
The Federal Network Agency provides guidelines and best practices for General Purpose AI (GPAI) models under the EU AI Act. These include transparency obligations, copyright regulations, and safety measures. The Code of Practice supports providers in complying with the EU AI Act.
Source: Bundesnetzagentur
The Federal Network Agency prepares the implementation of the EU AI Act in Germany. The regulation governs AI systems on a risk-based approach, with strict requirements for transparency and safety at high risk. Effective from August 2027.
Source: Bundesnetzagentur
The European Commission provides FAQs on implementing the EU AI Act. The regulation addresses risks to health, safety, and fundamental rights. It regulates prohibited AI systems, high-risk applications, transparency requirements, and general-purpose AI models.
Source: European Commission
The European Commission promotes harmonised standards for the EU AI Act to simplify compliance. These standards, developed by CEN, CENELEC, and ETSI, will be published from 2026 onwards. They provide legal certainty for providers of high-risk AI systems.
Source: European Commission
The European Commission promotes harmonized standards for high-risk AI systems to ensure legal certainty and set global benchmarks. CEN and CENELEC are developing standards in ten key areas, including risk management and transparency. The first harmonized standard was published on October 30, 2025.
Source: European Commission
The European Commission promotes harmonised standards for high-risk AI systems to ensure legal certainty and support innovation. These standards translate legal requirements into technical language, helping companies comply with the AI Act.
Source: European Commission
The General-Purpose AI Code of Practice was developed through an inclusive process with over 1000 participants from industry, civil society and authorities. It helps providers comply with the AI Act's requirements for safety, transparency and copyright. The code is voluntary and will be applied from August 2025.
Source: European Commission / AI Office
The voluntary GPAI Code of Practice supports providers in complying with AI Act requirements for safety, transparency, and copyright. Developed through a multi-stakeholder process, it includes three chapters, with safety and security applying only to providers with systemic risks.
Source: European Commission / AI Office
The General-Purpose AI Code of Practice is a voluntary EU Commission guideline developed by 13 independent experts with input from over 1,000 stakeholders. It assists providers in complying with AI Act rules for GPAI from August 2, 2025. The Code includes three chapters on transparency, copyright, and safety.
Source: European Commission / AI Office
The EU initiates the development of the first General-Purpose AI Code of Practice with four working groups on transparency, copyright rules, risk identification, technical risk mitigation, and internal risk management. Experts from academia, industry, and civil society will collaborate until April 2025 to create a comprehensive framework.
Source: European Commission / AI Office
The voluntary General-Purpose AI Code of Practice supports providers in complying with AI Act requirements on transparency, safety, and copyright. Published on July 10, 2025, it consists of three chapters.
Source: European Commission / AI Office
The EU promotes research and industrial AI capacity while ensuring safety and fundamental rights. The AI Act establishes a four-tier risk framework. Initiatives like AI Factories and InvestAI support innovation and investments.
Source: European Commission / DG CONNECT
Article 6 of the EU AI Act defines criteria for classifying AI systems as high-risk. An AI system is considered high-risk if it is used as a safety component of a product requiring third-party conformity assessment or listed in Annex III. Exceptions apply under specific conditions.
Source: European Commission / AI Act Service Desk
Article 5 of the EU AI Act prohibits AI systems that violate fundamental rights, such as manipulative techniques, exploitation of vulnerabilities, social scoring, and real-time remote biometric identification. Two additional prohibitions apply from 2 December 2026.
Source: European Commission / AI Act Service Desk
Article 2 of the EU AI Act defines the scope of the regulation. It specifies who is subject to the regulation when offering, deploying, importing, or distributing AI systems or general-purpose AI models within the EU. Military applications, research activities, and natural persons using AI for personal purposes are excluded.
Source: European Commission / AI Act Service Desk
Article 1 of the EU AI Act defines the regulation's subject matter. It establishes the objective to improve the internal market and promote trustworthy AI while protecting fundamental rights and safety. The regulation sets harmonised rules for AI systems.
Source: European Commission / AI Act Service Desk
The FAQs address common questions on enforcement and governance of the EU AI Act. They cover the responsibilities of the AI Office, EDPS, and national authorities, the establishment of complaint and whistleblower tools, and the application of rules for GPAI models and high-risk AI systems.
Source: European Commission / AI Act Service Desk
The EU Commission's AI Act Service Desk enables stakeholders to submit questions about the AI Act to the AI Office. Users can log in with EU Login, complete a form, and ask questions in any official EU language. Communication happens via email.
Source: European Commission / AI Act Service Desk
The AI Act Explorer by the European Commission is a reference tool for the EU AI Act (Regulation (EU) 2024/1689). It enables searching for prohibited practices, risk classifications, transparency obligations, and requirements for AI systems. The document has been supplemented by the Digital Omnibus Regulation (EU 2026/1744).
Source: European Commission / AI Act Service Desk
Regulation (EU) 2024/1689 establishes harmonized rules for artificial intelligence to strengthen the internal market and ensure a high level of protection for health, safety, and fundamental rights. It regulates high-risk AI systems, protects personal data, and promotes trustworthy, human-centric AI.
Source: EUR-Lex / Europäische Union