New edpb guidance forces companies to reassess ai data practices

EDPB guidance on AI and personal data: overview
From a regulatory standpoint, the EDPB issued updated guidance in early 2026 to clarify how the GDPR applies to artificial intelligence systems that process personal data. The guidance targets controllers and processors across the EU. It addresses risk assessment, transparency, purpose limitation and data minimisation for profiling, decision-making and automated processing. The Authority has established that stronger safeguards are required where AI use poses high risks to individuals.

1. normativa and the core elements of the guidance

The guidance reiterates principles established by the CJEU and earlier EDPB opinions while setting out concrete steps for operational compliance. Key elements include mandatory data protection impact assessments (DPIAs) for high-risk AI applications. The Authority has established stricter rules for automated individual decision-making that produces legal or similarly significant effects.

The guidance also requires clear documentation of training datasets, including provenance and lineage. Controllers must record bias mitigation measures and evaluation results. From a regulatory standpoint, the documentation obligation supports accountability and facilitates supervisory review.

Compliance risk is real: the EDPB emphasises that poor data minimisation or opaque profiling can trigger enforcement action. For organisations, the practical implications include stronger governance, updated contracts with processors, and demonstrable DPIA outcomes. The guidance signals closer scrutiny of model training practices and dataset sourcing.

2. Interpretation and practical implications

The guidance signals closer scrutiny of model training practices and dataset sourcing. From a regulatory standpoint, the Authority has established that organisations cannot rely on generic statements of legitimate interest or on broad consent when AI models infer sensitive attributes or produce significant effects on individuals.

The Authority requires that purpose limitation be respected across the model lifecycle, including training, validation and deployment. Organisations must demonstrate that each processing step aligns with the specified purpose and that purpose changes are documented and legally justified.

From a practical perspective, companies must be able to show the chain of processing activities from raw data to model outputs. Records should include preprocessing steps, the application of anonymisation or pseudonymisation, and concrete evidence that data minimisation and fairness controls were applied.

Compliance risk is real: auditors and supervisory authorities will expect accessible logs, reproducible pipelines and impact assessments. The Authority will treat the absence of such documentation as an indication of insufficient safeguards.

What companies should do next: map data flows tied to model development, keep immutable records of transformations, retain model validation reports, and document decisions about feature selection and exclusion of sensitive attributes. These measures reduce legal exposure and support transparent governance.

3. what companies must do now

These measures reduce legal exposure and support transparent governance. Compliance risk is real: organisations should act promptly.

• Conduct or update DPIAs tailored to AI systems, documenting specific risks, affected populations and planned mitigations.
• Map data flows supporting training and inference, including third-party sources, subprocessors and transfer mechanisms.
• Review lawful bases and transparency—verify legal grounds for processing and publish clear notices and meaningful explanations for automated decisions.
• Implement technical safeguards such as differential privacy, robust pseudonymisation, adversarial testing and continuous bias-evaluation pipelines.
• Adopt governance measures—appoint an AI compliance lead or data protection officer, maintain versioned audit trails and create approval gates for model updates.

From a regulatory standpoint, document decisions and retain evidence of risk assessments and mitigation steps. The Authority has established that such records are central to demonstrating compliance.

Practical steps for companies include embedding privacy-by-design into development sprints, running independent model audits, and training business teams on data minimisation and purpose limitation.

Compliance programmes should prioritise measurable controls, periodic reassessment and clear escalation paths to legal and security teams. The risk of enforcement and reputational harm rises if controls are absent or undocumented.

4. Risks and possible sanctions

The risk of enforcement and reputational harm rises if controls are absent or undocumented. From a regulatory standpoint, supervisory authorities may impose administrative fines under the GDPR, order processing to stop, or require specific remedial measures.

what sanctions look like

Fines under the GDPR can reach statutory maxima depending on the breach. The Authority has established that factors such as the gravity of the infringement, the degree of negligence, mitigation efforts, and cooperation with authorities shape the fine amount.

typical trigger events

Example: significant failures in data protection impact assessments, insufficient transparency for automated decisions affecting fundamental rights, or processing special-category data without safeguards. Such failures frequently prompt formal investigations and penalties.

practical consequences beyond fines

Enforcement often brings additional practical costs. Organisations face reputational damage, contractual liabilities with partners, and increased compliance expenses following corrective orders.

what companies should do next

Compliance risk is real: implement documented technical and organisational measures tailored to identified risks. Conduct targeted reviews where automated decision-making or sensitive data are involved. Demonstrable cooperation with regulators and timely remediation reduce enforcement exposure.

implications for governance

The Authority has established that transparent governance and recordkeeping influence regulatory assessments. Maintain clear documentation of risk assessments, decision logic for automated systems, and mitigation steps taken.

From a regulatory standpoint, prompt, evidence-based remediation and open engagement with supervisory authorities materially lower enforcement and reputational risks.

5. best practice checklist for compliance

From a regulatory standpoint, maintain momentum after remediation and engagement with authorities. The Authority has established that documented, repeatable controls reduce enforcement and reputational exposure.

1. Perform an AI-specific DPIA: map high-risk scenarios, identify affected data subjects and outline mitigation measures in plain language for non-specialists.
2. Document datasets: record provenance, consent status and quality checks. Include bias assessments and a brief note explaining why data choices matter for real users.
3. Adopt explainability measures: provide clear user-facing summaries of automated decisions and concise internal model cards for auditors and compliance teams.
4. Apply privacy-enhancing technologies: prefer anonymisation when feasible. Use pseudonymisation with strict access controls and logging for sensitive processing.
5. Set contractual safeguards: require processors and vendors to support GDPR compliance, deliver audit rights and commit to incident reporting timelines.
6. Train cross-functional teams: combine legal, data science and product staff in regular RegTech-driven reviews. Emphasize practical exercises and scenario drills.

Compliance risk is real: treat this checklist as operational, not theoretical. From a regulatory standpoint, regulators expect demonstrable evidence of ongoing monitoring and timely remediation.

What companies should do next is clear: adopt the checklist, document decisions and prepare to show regulators how controls work in practice. Expect supervisory scrutiny to focus on implementation and results rather than paperwork alone.

Actionable regulatory compliance

Expect supervisory scrutiny to focus on implementation and results rather than paperwork alone. From a regulatory standpoint, authorities expect evidence that controls work in practice.

The Authority has established that mere policies are insufficient. Regulators will test whether system outputs, vendor arrangements and mitigation measures deliver the promised protections.

Compliance risk is real: firms face fines, remediation orders and reputational damage if controls fail. From a practical perspective, companies should prioritise outcome-based metrics, independent testing and clear accountability for AI-driven processes.

For businesses operating across borders, coordination with national supervisory authorities remains essential. The Authority emphasises proportionality but will assess proportional measures against actual risk and harm.

Sources: EDPB guidance 2026, CJEU case law on automated decision-making, national supervisory authority notices (Garante Privacy and others).