01
Scope of application & addressees
- Organisations using personal data to develop or deploy AI recommendation and decision systems
- Service providers acting as data intermediaries for training, testing or deployment
- Privacy, data-governance, model-development and procurement teams
02
Core regulatory mandates & key requirements
01Assess the available personal-data basis for business improvement, research, contractual performance and other uses.
02Document data source, selection, quality, provenance and alignment with the model purpose.
03Give meaningful information to individuals and allocate data-protection duties in supplier contracts.
03
Enforcement & compliance timeline
A consultation draft was released.
The final advisory guidelines were published.