IDPC as FRA and MSA under the AI Act

07 March 2025

The coming into force of the Artificial Intelligence Act[1] ushers in a new era for legal certainty and for regulation in the field of innovative technology such as Artificial Intelligence (AI). The AI Act seeks to protect the fundamental rights and freedoms of individuals who may be affected by the autonomous decision-making capabilities of AI, being transparency, security, protection of personal data, robustness, accuracy, non-discrimination, and sustainability [2] - resonating predominantly, the regime of EU data protection law, namely the General Data Protection Regulation (GDPR).[3]

National data protection supervisory authorities have accordingly been specifically identified as national competent authorities under the AI Act for the monitoring and safeguarding of individuals’ fundamental rights and freedoms on a number of levels.

On 2 November 2024, the Information and Data Protection Commissioner (the “IDPC”) has been designated as the Fundamental Rights Authority (‘FRA’) for the purposes of the AI Act, insofar as the monitoring of the protection of personal data is concerned.

The AI Act also provides that national data protection supervisory authorities may be designated by Member States as Market Surveillance Authorities (‘MSA’) responsible for monitoring high-risk AI systems prescribed under Annex III to the AI Act, which threaten, predominantly, the right to privacy and protection of data of individuals. By 2 August 2025, the IDPC will be designated as MSA for AI systems used for law enforcement purposes, border management and justice and democracy – these high-risk AI systems are listed under points 1,6, 7 and 8 of Annex III of the AI Act.  The IDPC may also be designated as MSA for other high-risk AI systems identified in Annex III.  

[1] Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act).

[2] Regulation (EU) 2024/1689, article 3.

[3] Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).