On June 3, 2024, the European Data Protection Supervisor (EDPS) published guidelines on generative Artificial Intelligence (AI) and personal data for European Union (EU) institutions, bodies and agencies. The guidelines aim to help these organizations comply with the data protection obligations set out in Regulation (EU) 2018/1725 when using or developing generative AI tools. The guidelines are issued as part of the EDPS's data protection authority role and do not provide an interpretation of the AI Act.

The guidelines aim to cover a wide range of data processing scenarios, technologies and applications. In addition, the guidelines outline that Data Protection Impact Assessments (DPIAs) are necessary for high-risk processing operations, with regular monitoring to manage evolving risks.