Hostname: page-component-74656f9884-c52kr Total loading time: 0 Render date: 2026-11-07T04:10:38.800Z Has data issue: false hasContentIssue false
  • English
  • Français

Beyond the DPO Model? The EU AI Act’s Accountability Framework Without a Mandated AI Officer

Published online by Cambridge University Press:  23 October 2026

Zhicheng He Open the ORCID record for Zhicheng He [Opens in a new window]
Zhicheng He*
Affiliation:
Department of Law, Stockholm University, Sweden
*
Email: zhicheng.he@juridicum.su.se
Rights & Permissions [Opens in a new window]

Abstract

The EU AI Act presents an institutional puzzle. Although it imposes extensive obligations on providers of high-risk AI systems and requires such systems to be subject to human oversight, it does not create a designated governance function comparable to the Data Protection Officer (DPO) mandated under the GDPR in specified circumstances. Examining this difference through an organisational lens, the article argues that both regimes combine entity-level accountability with internal compliance requirements; their central institutional difference lies in whether the law also mandates a designated cross-cutting governance function. The GDPR does so through the DPO, whereas Article 17 of the AI Act requires providers’ quality management systems to include an accountability framework setting out the responsibilities of management and other staff but leaves providers to determine how those responsibilities are coordinated internally. Drawing on comparative legal analysis, including consideration of the Digital Omnibus on AI, the article identifies proportionality, organisational flexibility and reliance on existing sectoral governance arrangements as possible explanations for this difference. An illustrative examination of corporate practices further shows how some organisations use AI officers, ethics committees and embedded review processes to coordinate distributed compliance responsibilities even where no such coordinating function is legally mandated.

Keywords

AI officeraccountability frameworkcorporate AI governance

Information

Type
Articles
Information
European Journal of Risk Regulation , First View , pp. 1 - 15
Creative Commons
Creative Common License - CCCreative Common License - BY
This is an Open Access article, distributed under the terms of the Creative Commons Attribution licence (https://creativecommons.org/licenses/by/4.0/), which permits unrestricted re-use, distribution and reproduction, provided the original article is properly cited.
Copyright
© The Author(s), 2026. Published by Cambridge University Press

I. Introduction

The EU Artificial Intelligence Act (AI Act) raises a distinctive question of institutional design. Like the General Data Protection Regulation (GDPR), it combines entity-level accountability with a range of internal compliance requirements. The GDPR places primary responsibility for compliance on data controllers,Footnote 1 and where relevant, data processors, while requiring the designation of a Data Protection Officer (DPO) in specified circumstances.Footnote 2 The DPO does not itself assume the controller’s or processor’s responsibility for GDPR compliance.Footnote 3 Rather, it performs advisory, monitoring and communication functions as an identifiable and statutorily safeguarded governance interface for the organisation.Footnote 4 By contrast, the AI Act assigns extensive obligations to defined regulated entities, particularly providers and deployers, but does not require a comparable designated internal governance function.Footnote 5

This difference is notable in light of the AI Act’s accountability architecture for high-risk AI systems. Article 17 requires providers to establish a quality management system, including an accountability framework “setting out the responsibilities of the management and other staff.”Footnote 6 Article 14 requires high-risk AI systems to be designed and developed so that they can be effectively overseen by natural persons,Footnote 7 while Article 26(2) requires deployers to assign human oversight to natural persons with the necessary competence, training and authority.Footnote 8 The AI Act therefore does not dispense with human involvement, but it stops short of requiring providers to include within the Article 17 accountability framework a designated function comparable to the DPO.

This article adopts an organisational perspective to examine this institutional feature of the AI Act. Its central claim is specific: the GDPR and the AI Act both combine entity-level accountability with internal compliance mechanisms, but differ in whether the law incorporates a designated and statutorily safeguarded cross-cutting governance function into the internal accountability framework. The GDPR supplements the legal responsibilities of controllers and processors with the DPO, which has defined tasks and institutional safeguards. Article 17 of the AI Act, by contrast, requires providers to establish an accountability framework without prescribing an equivalent officer or cross-cutting function within that framework. This approach may preserve flexibility across diverse technologies and organisational settings, but it may also generate new governance challenges, including difficulties for both internal coordination and external regulatory oversight. The illustrative corporate practices examined below show how some organisations respond by establishing governance focal points voluntarily.

Existing scholarship spanning the proposal and final-text stages has examined the AI Act’s risk-based structure,Footnote 9 its fundamental-rights implications,Footnote 10 and specific compliance requirements,Footnote 11 including human oversight.Footnote 12 Far less attention has been paid to the internal organisational architecture through which these requirements are expected to operate. This gap matters because the practical implementation of AI regulation depends not only on the allocation of duties to providers and deployers, but also on how those entities organise expertise, authority and communication within their own structures.

Against this background, the article addresses two questions. First, why does the AI Act require providers of high-risk AI systems to establish an accountability framework while refraining from mandating a designated governance function comparable to the GDPR’s DPO? Second, what forms of organisational response can be observed in publicly documented AI governance practice?

The article proceeds in four steps. Section II examines the DPO as a designated and statutorily safeguarded governance function within the GDPR’s broader accountability framework. Section III analyses the AI Act’s organisational accountability architecture, focusing on Article 17’s quality management system and accountability framework before situating human oversight under Articles 14 and 26 within that structure. Section IV offers an illustrative, non-exhaustive analysis of emerging organisational responses, including AI officers, governance committees and process-integrated arrangements. Section V synthesises these findings and argues that AI accountability may be strengthened when entity-level responsibility and distributed compliance requirements are complemented by identifiable governance focal points.

II. The DPO as a designated governance function within the GDPR’s accountability framework

Within the GDPR framework, the DPO functions as a legally mandated organisational interface between regulatory norms and organisational practice in specified circumstances.Footnote 13 Whether the function is performed internally by a staff member of the controller or processor or externally under a service contract, the designation of a DPO creates a structural point of contact at the intersection of law, organisational governance and supervisory oversight.Footnote 14 This function should be understood within the GDPR’s broader accountability architecture. The GDPR combines entity-level responsibility with various internal compliance requirements. The DPO neither displaces those requirements nor assumes the controller’s or processor’s responsibility for compliance. Instead, in the circumstances specified by Article 37, the DPO provides an identifiable and statutorily safeguarded focal point within that wider framework. It is this institutional feature that provides the relevant baseline for comparison with the AI Act.

The GDPR gives this institutional design concrete legal form. Controllers and processors must designate a DPO in specified circumstances, notably where processing is carried out by a public authority or body, or where their core activities involve the regular and systematic monitoring of data subjects on a large scale or the large-scale processing of special categories of personal data.Footnote 15 Functionally, the DPO’s principal tasks include advising the controller or processor on their data protection obligations and monitoring compliance with both the GDPR and internal organisational policies.Footnote 16 The GDPR further introduces structural safeguards intended to secure the DPO’s institutional position, including guarantees of independence, the avoidance of conflicts of interest, and direct reporting lines to the highest level of management.Footnote 17 Of these safeguards, the guarantee of statutory independence is central to the DPO’s institutional position. The GDPR expressly provides that the DPO may not be dismissed or penalised for performing their tasks.Footnote 18

Taken together, these safeguards give the DPO a protected capacity within the corporate hierarchy: the DPO may raise compliance concerns without receiving instructions or suffering retaliation for the performance of their statutory tasks, including where those concerns conflict with management’s commercial preferences.Footnote 19 Crucially, these protections do not transfer legal responsibility for compliance from the controller or processor to the DPO.Footnote 20 National supervisory practice has progressively given operational content to these safeguards by examining whether concurrent managerial responsibilities create conflicts of interest,Footnote 21 whether DPOs are afforded sufficient time and organisational access,Footnote 22 and whether the DPO reports directly to the highest level of management.Footnote 23

This institutional design also serves an important coordination function. The DPO is not intended to centralise all data protection responsibilities within the organisation. Rather, the function supports coordination within complex organisational structures by providing a stable focal point through which compliance issues can be identified, communicated and followed up across departments.Footnote 24 Externally, the DPO serves as a designated interface with supervisory authorities and a contact point for data subjects, facilitating regulatory oversight and the exercise of rights.Footnote 25 These internal and external functions make the DPO an identifiable governance focal point within the GDPR’s broader accountability framework. In this sense, the DPO provides a “human face” for data protection governance, one that reflects the broader regulatory philosophy of EU data protection law, i.e., a rights-oriented governance approach grounded in the protection of individual fundamental rights rather than purely probabilistic assessments of technological risk.Footnote 26

The use of a designated organisational function as a compliance focal point is not unique to the GDPR. Other fields of EU law employ designated roles for related, although not identical, purposes, including anti-money laundering law,Footnote 27 aviation safety regulation,Footnote 28 and law enforcement data protection under the Law Enforcement Directive.Footnote 29 These roles differ in their mandates, legal safeguards and allocations of responsibility and should not be understood as instances of a uniform officer model. They nevertheless illustrate a recurring institutional technique: where ongoing regulatory obligations require sustained monitoring, coordination or communication with public authorities, EU law may require an identifiable organisational function to perform or coordinate those activities.

Nevertheless, the DPO model is not without structural vulnerabilities. Pre-GDPR socio-legal research into national privacy-officer arrangements has already highlighted the risks of formalisation and the potential marginalisation of privacy officers within organisational hierarchies.Footnote 30 These critiques demonstrate that the mere creation of a designated role does not automatically guarantee effective oversight. The practical effectiveness of such roles remains contingent on organisational power dynamics, resources and institutional culture.Footnote 31 Recent coordinated enforcement activity and national supervisory decisions have given these requirements more concrete content by addressing proper designation, adequate resources, independence, conflicts of interest and direct access to senior management, demonstrating that the DPO’s institutional position continues to develop in practice.Footnote 32 These developments reinforce rather than undermine the analytical significance of the DPO. Against this baseline, the following section examines how the AI Act structures internal accountability through Article 17 without mandating an equivalent designated and protected internal focal point.

III. The AI Act’s organisational accountability architecture

Unlike the GDPR, the AI Act combines elements of EU product safety law with a fundamental rights regulatory agenda. The result is a hybrid governance framework in which ex ante conformity assessments, lifecycle monitoring and human oversight operate as systemic safeguards for high-risk AI systems.Footnote 33 This does not mean that the AI Act lacks defined legal actors. On the contrary, it allocates extensive obligations to providers, deployers and other operators at different stages of an AI system’s lifecycle.Footnote 34 The central question for present purposes is how these entity-level obligations are translated into internal organisational arrangements. This section first considers the risk-based structure through which obligations are triggered, then examines the accountability framework required by Article 17, before situating human oversight under Articles 14 and 26 within that broader architecture.

1. Risk-based regulation and the allocation of duties

The AI Act adopts a risk-based framework that calibrates regulatory obligations according to the perceived severity of potential harm, ranging from “unacceptable” to “minimal” risk.Footnote 35 Rather than imposing uniform requirements, this layered structure seeks to align the intensity of regulatory intervention with the risks associated with particular systems and contexts of use.

Within this architecture, the high-risk classification is especially significant because it triggers extensive compliance obligations that target system design and lifecycle management.Footnote 36 These obligations include the establishment of risk-management systems, data and data governance requirements, technical documentation requirements and a post-market monitoring system.Footnote 37 In this respect, the AI Act reflects broader regulatory approaches found in EU product safety regimes, where systemic safeguards and technical standards play a central role in preventing harm. These obligations are directed principally at providers, who bear responsibility for ensuring that high-risk AI systems comply with the requirements of the AI Act before they are placed on the market or put into service.Footnote 38 Deployers are, in turn, subject to duties concerning the use of those systems in their particular operational contexts.Footnote 39 The comparison with the DPO accordingly centres on the provider, since it is the provider that bears the quality management and accountability framework obligation; the position of deployers is instead addressed through the human oversight duties discussed in Section III.3. The Act is therefore both system-oriented and actor-based: it regulates the characteristics and lifecycle of high-risk systems while allocating defined legal duties to the entities that develop and use them.

Legal scholarship has nevertheless questioned whether the Act’s risk classifications consistently reflect the risks posed by particular systems and uses. In particular, the predefined categories in Annex III may be over- or under-inclusive.Footnote 40 These categories are not fixed, however: Article 7 empowers the Commission to amend Annex III through delegated acts, subject to specified conditions.Footnote 41 Moreover, the Act primarily focuses on harm mitigation while providing limited mechanisms for systematically weighing the potential societal benefits of AI systems.Footnote 42 For the purposes of this article, however, the significance of the risk-based architecture lies less in the merits of risk classification than in its organisational implications. Risk classification determines when heightened obligations arise; Article 17 addresses how providers must organise themselves to meet those obligations. The timeline for these obligations has since been amended. Regulation (EU) 2026/1744 (the “Digital Omnibus on AI”), which entered into force on 27 July 2026, postponed the application of the high-risk requirements, including Article 17, to 2 December 2027 for systems falling under Annex III and to 2 August 2028 for systems falling under Annex I.Footnote 43 The Article 17 obligations discussed here are therefore not yet applicable.

2. Article 17 and the internal accountability framework

Article 17 provides the principal organisational anchor for the AI Act’s high-risk regime. It requires providers to establish, document and maintain a quality management system capable of ensuring compliance with the Regulation.Footnote 44 This system must take the form of written policies, procedures and instructions, and must cover a wide range of compliance activities, including risk management, post-market monitoring, incident reporting, documentation, communication with competent authorities, resource management and record-keeping.Footnote 45

Most importantly, Article 17(1)(m) requires the quality management system to include an “accountability framework” setting out the responsibilities of “management and other staff” in relation to these activities.Footnote 46 This requirement makes clear that the AI Act does not leave internal responsibility wholly unspecified. It requires providers to allocate responsibility across the organisation and to embed that allocation among management and staff.

Article 17 is therefore an appropriate point of comparison with the DPO framework under the GDPR. Both address the organisational conditions through which a regulated entity is expected to comply with legal obligations. Yet they do so differently. The GDPR requires the designation of a DPO in specified circumstances and gives that function defined tasks and institutional safeguards.Footnote 47 In practice, DPOs may serve as focal points for coordinating data protection compliance activities and facilitating interaction with supervisory authorities.Footnote 48 By contrast, Article 17 of the AI Act requires an accountability framework, but does not prescribe that the framework be coordinated by a designated officer comparable to the DPO. Nor does it preclude providers from establishing such a function voluntarily. Rather, it leaves the institutional form of internal coordination to the provider. Providers must therefore determine, through their own governance arrangements, how legal, technical and operational expertise is brought together. Socio-technical research on responsible AI governance suggests that such coordination may be difficult in complex organisational settings, particularly where responsibility is dispersed across specialist units.Footnote 49

One institutional implication concerns communication with competent authorities. Under Article 39 GDPR, the DPO is required to cooperate with the supervisory authority and to act as a contact point on issues relating to processing, including prior consultation where appropriate.Footnote 50 The AI Act does not establish an equivalent mandatory governance officer. It does, however, require providers to include procedures for handling communication with national competent authorities and other relevant actors in their quality management systems.Footnote 51 The relevant contrast is therefore not between the presence and absence of regulatory communication. Rather, under the GDPR, this communicative function is attached to a designated and statutorily safeguarded governance function, whereas under the AI Act it is incorporated into an organisational procedure without designating who must coordinate or perform it. Whether this institutional difference produces practical coordination difficulties is ultimately an empirical question, but it helps explain why organisations may establish dedicated AI governance functions voluntarily.

The AI Act does, however, contain several mechanisms that approximate aspects of the DPO’s protected position without replicating it as a cross-cutting internal function. For example, Article 87 extends the whistleblower protection regime to reports of AI Act infringements, including its safeguards against retaliation.Footnote 52 In the sectoral context, Article 17(3) permits providers already subject to quality management obligations under Union harmonisation law to integrate the Article 17(1) elements into those systems;Footnote 53 for AI-enabled medical devices, this includes the person responsible for regulatory compliance, who “shall suffer no disadvantage within the manufacturer’s organisation in relation to the proper fulfilment of his or her duties.”Footnote 54 Articles 17(4) and 26(5) similarly deem the relevant obligations fulfilled where financial institutions comply with internal governance rules under Union financial services law, which in some sectors include dedicated control functions;Footnote 55 and Article 22(4) requires an authorised representative to terminate its mandate, and to inform the market surveillance authority, where it has reason to consider that the provider is acting contrary to its obligations.Footnote 56 These provisions confirm that protected, sector-specific compliance functions are not incompatible with the AI Act; but the Act largely draws on protections that an existing sectoral or horizontal instrument already supplies. What the AI Act does not do is create, for high-risk AI systems generally, a DPO-equivalent coordinating function of its own.

3. Human oversight within the accountability framework

Human oversight is another important component of the AI Act’s high-risk regime, although its meaning, functions and practical effectiveness remain contested in the literature.Footnote 57 For the purposes of the AI Act, it is given a more specific legal form through Article 14, which requires high-risk AI systems to be designed and developed, including through appropriate human–machine interface tools, so that they can be effectively overseen by natural persons during the period in which they are in use.Footnote 58 Scholars have nevertheless questioned whether the formal presence of a human overseer is sufficient to produce meaningful oversight, particularly where automation bias, limited understanding of the system or inadequate organisational authority constrains the overseer’s ability to intervene.Footnote 59

Importantly, Article 14 itself does not prescribe a specific organisational role or designate a responsible officer. Human oversight is instead formulated as a functional requirement: a technical and procedural capability that enables human actors to understand system limitations, detect anomalies, remain aware of automation bias and intervene where necessary to mitigate risks to safety or fundamental rights.Footnote 60 Article 26(2) complements this design obligation by requiring deployers to assign human oversight to “natural persons” with the necessary competence, training and authority, as well as the necessary support.Footnote 61 The provision is important precisely because it demonstrates that the AI Act does require the involvement of persons for operational oversight.

That involvement of natural persons, however, is not equivalent to the designation of a DPO. The persons assigned under Article 26(2) are responsible for overseeing the use of particular high-risk AI systems. They are not thereby given a general statutory mandate to monitor organisational compliance, advise management across the AI governance framework, or serve as an independent interface with supervisory authorities. Article 14 imposes design obligations on providers and is, in this respect, closer to the data-protection-by-design obligation in Article 25 GDPR, whereas the safeguard of human intervention in Article 22(3) GDPR finds its nearer counterpart in the operational oversight that Article 26(2) requires deployers to assign to designated natural persons. These are functional parallels rather than equivalent requirements. Neither provides an apt direct comparator for the DPO’s organisational functions.Footnote 62

The AI Act thus requires both an internal accountability framework and designated natural persons for specific oversight tasks, but it does not prescribe a designated governance node responsible for coordinating the framework as a whole. This leaves organisations with substantial discretion to determine how legal, technical and operational expertise should be brought together. The next section considers illustrative corporate responses to this institutional space, including dedicated AI officers, cross-functional committees and process-integrated governance arrangements.

IV. Organising AI governance in practice: illustrative corporate responses

Although the AI Act does not require a designated and protected cross-cutting governance function comparable to the DPO, organisations have nonetheless developed internal structures to allocate governance tasks, coordinate expertise and operationalise AI governance in complex socio-technical environments. High-profile controversies, including biased recruitment algorithms and liability disputes involving autonomous vehicles, have highlighted the risks associated with uncritical AI deployment and contributed to corporate commitments to “responsible AI.”Footnote 63 These commitments typically converge around a shared set of normative principles, including transparency, fairness, non-maleficence, accountability and privacy protection.Footnote 64 However, translating such principles into operational decision-making structures remains challenging. A substantial body of scholarship on corporate AI governance identifies a persistent gap between the public articulation of responsible AI principles and their effective operationalisation within organisational practice.Footnote 65 Against this background, this section examines several organisational approaches to implementing AI governance. The examples discussed in this section were selected from publicly documented practices, primarily those of technology companies developing or offering AI products or services, to illustrate different organisational approaches to AI governance rather than provide an exhaustive survey.

1. Individualised governance: the emergence of the AI officer

One visible organisational response is the emergence of specialised executive roles responsible for coordinating AI governance, often labelled “Chief AI Officer” (CAIO) or similar titles such as “AI Risk Officers.”Footnote 66 For present purposes, the AI officer is best understood as a coordination node intended to bridge technical, legal and managerial domains. This development is not confined to the private sector. For example, the United States federal administration required covered federal agencies to retain or designate a Chief AI Officer responsible for coordinating AI use and managing associated risks, signalling the institutionalisation of this governance model within the public sector as well.Footnote 67

However, the creation of a dedicated AI officer remains contested. Questions persist regarding the scope of authority of such roles, their relationship to existing positions such as DPOs or compliance officers, and the risk that centralising responsibility in a single role may inadvertently enable the diffusion of accountability elsewhere in the organisation.Footnote 68 Significantly, in the corporate context, the emergence of AI officer roles may be understood as a voluntary attempt to create an identifiable governance focal point, indicating that at least some organisations perceive value in central coordination even where no equivalent function is legally required.

2. Collective governance: ethics committees and multi-level oversight

A second organisational strategy relies on collective governance structures, typically in the form of internal AI ethics boards or cross-functional oversight committees. These bodies seek to institutionalise deliberation, escalation and coordination across organisational units involved in AI development and deployment. Unlike the individualised model, collective governance distributes epistemic authority across legal, technical and ethical domains and is intended to reduce the risk that governance is dominated by any single organisational perspective.

Some large technology firms have adopted collective governance frameworks that combine strategic oversight with operational review processes. For example, organisations may establish senior-level advisory bodies that define risk tolerance and governance policies, alongside operational review committees responsible for evaluating AI-related risks during product development.Footnote 69 In certain cases, additional ethics focal points embedded within business units are tasked with identifying and escalating concerns.Footnote 70 An EU-based illustration is SAP, whose publicly described governance structure includes an internal Global AI Ethics Steering Committee and an external Global AI Ethics Advisory Panel. The former brings together senior company leaders to review governance processes and product capabilities, while the latter provides external expertise.Footnote 71 This example illustrates how collective internal oversight may be supplemented by external advice.

Comparable committee-based models also appear in enterprise governance platforms and compliance frameworks, where cross-functional governance committees integrate legal, technical, security and product expertise into structured intake and review procedures.Footnote 72 In these models, human review becomes a key decision-making mechanism, particularly for higher-risk AI applications. Committee-based governance thus institutionalises accountability through deliberation and escalation. Rather than relying on a single decision-maker, responsibility is distributed across a structured forum that brings together diverse forms of expertise.Footnote 73

3. Embedded governance: process-integrated and “full-stack” models

A third organisational approach embeds AI governance directly into technical development processes and product lifecycle management. Instead of relying primarily on identifiable governance actors or committees, this model integrates governance and compliance mechanisms into documentation practices, risk assessments and product development workflows.

Google’s “full-stack” AI governance provides one illustration of this model.Footnote 74 As publicly described, the framework combines several layers: overarching normative principles and policies,Footnote 75 structured review procedures embedded within development cycles, and extensive documentation practices that record design decisions, testing results and risk assessments.Footnote 76 These documentation practices create internal audit trails that allow organisations to trace how governance considerations were addressed throughout the lifecycle of an AI system.Footnote 77 In organisational terms, governance tasks are therefore distributed across multiple teams, including engineering, product management, legal and responsible AI units, rather than concentrated in a single institutional node. While embedded governance offers flexibility and close alignment with technical development processes, it may also raise concerns regarding the independence and visibility of oversight functions, particularly in high-risk or controversial use cases.

V. Explaining the institutional difference and organisational response

At first glance, the absence of an AI Act-specific governance role comparable to the DPO might appear to constitute a regulatory gap. A closer examination, however, shows that Article 17 does not leave accountability unallocated: it holds the provider legally responsible while requiring tasks to be allocated internally among management and other staff. At the same time, the illustrative practices examined in Section IV show that some organisations voluntarily establish identifiable governance focal points to enhance corporate AI governance. The analysis therefore turns first to why the AI Act leaves the form of internal coordination to providers, before considering why some organisations nevertheless establish officers, committees or other governance focal points.

1. Explaining the absence of a mandated governance function

The absence of a mandated governance function comparable to the GDPR’s DPO can be interpreted in light of several regulatory considerations. These considerations do not necessarily reflect explicit legislative intentions but rather broader regulatory logics embedded in the design of the AI Act.

First, leaving the form of internal coordination unspecified may be consistent with concerns about institutional rigidity in a rapidly evolving technological field. AI technologies and their organisational applications continue to develop at a pace that makes stable governance models difficult to predict.Footnote 78 Mandating a specific organisational role might therefore risk locking organisations into governance structures that could become outdated as technological and organisational practices evolve. This emphasis on organisational flexibility is reflected in Article 17 itself, which requires the implementation of the quality management system to be “proportionate to the size of the provider’s organisation,” thereby allowing providers to adapt their internal arrangements to their particular circumstances.Footnote 79 The subsequent amendments introduced by the Digital Omnibus on AI further reinforce this proportionate and flexible approach by broadening access to simplified quality management arrangements for eligible SMEs, including start-ups, and to simplified technical documentation for SMEs, including start-ups, and small mid-cap enterprises.Footnote 80

Here, the legislative history of the AI Act also provides important contextual background for this institutional design. In its 2021 Proposal, the Commission framed the regulatory architecture as a “balanced and proportionate horizontal regulatory approach” intended to be “limited to the minimum necessary requirements.”Footnote 81 The accompanying Impact Assessment also identified flexibility and future-proofness as core design criteria, noting that the preferred regulatory option should avoid the “unnecessary slowing of uptake” while incorporating mechanisms through which the framework could be adapted as the technology evolves.Footnote 82 Taken together, these considerations are consistent with leaving the form of internal coordination open to providers. The AI Act’s emphasis on adaptability was particularly relevant given the opacity, complexity, continuous adaptation and autonomous behaviour that the Commission identified as distinctive characteristics of AI systems.Footnote 83

The Commission’s choice between regulatory options further illustrates this orientation. The preference for Option 3+ (mandatory requirements for high-risk AI combined with voluntary codes of conduct) over Option 4 (universal mandatory requirements) was expressly justified on proportionality grounds.Footnote 84 By concentrating mandatory requirements on high-risk systems, the preferred option preserved organisational flexibility and allowed internal governance arrangements to develop alongside technological innovation. Although these materials do not show that the Commission specifically rejected a mandatory AI officer, they provide contextual support for the AI Act’s flexible and risk-differentiated architecture.

Second, the absence of a mandatory AI officer can be interpreted as a strategy to avoid formalistic or “tick-box” compliance. One possible concern is that mandating an AI officer could encourage organisations to channel the bulk of day-to-day AI compliance management through a single specialist function, thereby encouraging formalistic or “tick-box” compliance. Article 17 instead requires providers to allocate responsibilities among management and other staff without assigning a single governance mandate. This approach reflects broader regulatory strategies aimed at embedding compliance within organisational processes rather than concentrating responsibility in a single compliance function.Footnote 85

Third, the difference may partly reflect the distinct regulatory objects and institutional scope of the two legal instruments. The GDPR regulates the processing of personal data and establishes enforceable rights for data subjects, while the AI Act governs a heterogeneous range of AI systems, uses and operators through a horizontal lifecycle framework that also seeks to protect fundamental rights.Footnote 86 This diversity may help explain why Article 17 of the AI Act permits providers to adapt their internal governance arrangements to their organisational circumstances, although it does not make a DPO-equivalent function inherently incompatible with the AI Act. The two instruments are also cumulative rather than mutually exclusive: where an AI system processes personal data, applicable GDPR obligations – including any requirement to designate a DPO – continue to operate alongside the AI Act.

This interaction is not merely formal. Article 26(9) requires deployers to use the information provided by the provider under Article 13 when carrying out a data protection impact assessment (DPIA) under the GDPR, which requires the controller to seek the advice of the DPO where one has been designated.Footnote 87 Where a DPIA is required for a high-risk AI deployment involving personal data, the DPO is therefore already positioned to advise on the assessment that feeds into that system’s deployment. The revised Article 27(4) further connects these assessments by allowing deployers to cross-refer to, or incorporate relevant parts of, a DPIA when conducting a fundamental rights impact assessment (FRIA) under the AI Act.Footnote 88 This suggests that, in many high-risk settings involving personal data, coordination of AI governance need not begin from nothing: an existing DPO may in practice perform certain coordinating functions. Such coordination, however, does not extend the DPO’s statutory mandate to the AI Act’s broader requirements.

Taken together, these considerations suggest that the absence of a mandated AI governance function should not automatically be treated as a regulatory omission. It is consistent with an architecture that combines entity-level accountability with proportionate and adaptable internal compliance arrangements while leaving their coordinating form largely to providers.

2. The organisational demand for governance anchors

The illustrative and non-exhaustive examples examined in Section IV do not establish the prevalence of particular governance models or demonstrate that they arose in response to the AI Act. They nevertheless show how some organisations supplement distributed internal compliance arrangements with identifiable focal points for coordination. For analytical purposes, the selected examples can be grouped into three broad forms. Some organisations establish specialised executive roles, such as Chief AI Officers or AI risk managers, in order to coordinate AI governance and align technical development with regulatory compliance.Footnote 89 Others rely on collective governance structures, including ethics committees or cross-functional oversight bodies that bring together legal, technical and managerial expertise.Footnote 90 A third approach embeds governance directly into technical development processes through lifecycle reviews, documentation practices and internal audit mechanisms.Footnote 91

Importantly, none of these approaches, merely by virtue of its organisational form, replicates the DPO’s combination of legal designation, defined statutory tasks and institutional safeguards. The first two place an identifiable actor or forum at the centre of the arrangement, whereas embedded governance does not necessarily create a distinct governance node and may instead distribute governance tasks across teams and workflows. What the three approaches share is therefore not the recreation of an identifiable node, but an effort to coordinate expertise, structure decision-making and render AI governance operational. These examples suggest that some organisations perceive practical value in stable coordination arrangements; absent a legal designation requirement, however, the existence, authority, independence and continuity of any governance focal point remain matters of organisational choice.

VI. Conclusion

This article has shown that both the GDPR and the AI Act combine entity-level legal accountability with internal compliance requirements. Their institutional difference is specific: the GDPR requires a designated and statutorily safeguarded governance function, i.e., the DPO, in specified circumstances, whereas Article 17 of the AI Act requires providers of high-risk AI systems to establish an accountability framework but does not prescribe an equivalent cross-cutting function to coordinate it. Although Articles 14 and 26 require natural persons to perform system-specific human oversight, those persons are not thereby given an organisation-wide mandate comparable to that of the DPO.

The Digital Omnibus on AI and other legislative materials do not establish that the EU legislature specifically rejected an AI officer model. They nevertheless indicate that proportionality, flexibility and future-proofness shaped the AI Act’s regulatory architecture and provide context for leaving the form of internal coordination to providers. The selected corporate practices further illustrate how some organisations voluntarily supplement distributed compliance arrangements with officers, committees or other identifiable focal points.

Taken together, these findings point towards a hybrid institutional architecture for corporate AI governance. Entity-level legal accountability and distributed internal compliance requirements may be complemented by governance arrangements capable of coordinating their implementation. Such arrangements would not replace the legal accountability of providers or the applicable duties of deployers. Their function would instead be to bring together legal, technical and operational expertise; coordinate compliance before deployment and during operation and post-market monitoring; escalate unresolved risks to senior management; and facilitate communication with competent authorities.

Regulatory guidance and soft-law instruments could recognise these coordinating functions without prescribing a single title or organisational model. The General-Purpose AI Code of Practice already illustrates this kind of soft-law recognition, asking signatories to allocate responsibility for systemic-risk oversight, ownership, support and monitoring, and assurance across organisational levels;Footnote 92 although it concerns general-purpose AI models, an analogous approach could inform guidance under the high-risk regime. This study, however, does not establish which arrangement is most effective. Its analysis of corporate practice is illustrative rather than representative and relies principally on publicly documented governance frameworks, which may reflect organisations’ stated structures rather than their operation in practice. It therefore cannot determine the prevalence of particular models, whether they were adopted in response to the AI Act, or their effectiveness in preventing harm and securing compliance. Further empirical research should compare these arrangements across sectors, organisational sizes and categories of AI systems, paying particular attention to the focal point’s mandate, resources, access to information, escalation authority and relationship with senior management and competent authorities.

Competing interests

The author declares none.

References

1 For the data controller’s compliance responsibilities, see Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) [2016] OJ L119/1, Arts. 5(2), 24(1) and 32.

2 For the circumstances in which a DPO must be designated, see ibid., Art. 37.

3 For further discussion of the role of the DPO, see C. Kuner and others, EU General Data Protection Regulation (GDPR): A Commentary (Oxford University Press 2020), the commentary on Arts. 37–39, pp. 688–715.

4 GDPR, Arts. 38–9.

5 Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (Text with EEA relevance) [2024] OJ L 12.7.2024, Arts. 3(3)–(4), 16, 17 and 26. Unless otherwise indicated, references to the AI Act are to Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (the “Digital Omnibus on AI”).

6 Ibid., Art. 17(1)(m).

7 Ibid., Art. 14(1).

8 Ibid., Art. 26(2).

9 For further discussion of the AI Act’s risk-based approach, see, for example, S. Greenstein and M. Zamboni, “Navigating the Legislative Dilemma: Evaluating the EU AI Act’s Approach to Regulating Emerging Technologies” (2025) 13 Theory and Practice of Legislation 312 <https://doi.org/10.1080/20508840.2025.2513177>; M. Ebers, “Truly Risk-Based Regulation of Artificial Intelligence How to Implement the EU’s AI Act” (2025) 16 European Journal of Risk Regulation 684 <https://doi.org/10.1017/err.2024.78>. See also M. Veale and F. Zuiderveen Borgesius, “Demystifying the Draft EU Artificial Intelligence Act – Analysing the Good, the Bad, and the Unclear Elements of the Proposed Approach” (2021) 22 Computer Law Review International 97 <https://doi.org/10.9785/cri-2021-220402>.

10 On the AI Act’s fundamental-rights implications, see F. Palmiotto, “The AI Act Roller Coaster: The Evolution of Fundamental Rights Protection in the Legislative Process and the Future of the Regulation” (2025) 16 European Journal of Risk Regulation 770 <https://doi.org/10.1017/err.2024.97>.

11 See, for example, J. Mökander and others, “Conformity Assessments and Post-Market Monitoring: A Guide to the Role of Auditing in the Proposed European AI Regulation” (2022) 32 Minds and Machines 241 <https://doi.org/10.1007/s11023-021-09577-4>.

12 L. Enqvist, “‘Human Oversight’ in the EU Artificial Intelligence Act: What, When and by Whom?” (2023) 15 Law, Innovation and Technology 508 <https://doi.org/10.1080/17579961.2023.2245683>.

13 For the circumstances in which a DPO must be designated, see GDPR, Art. 37.

14 The DPO may be either an employee of the organisation or an external service provider under the GDPR. See ibid., Art. 37(6).

15 For a list of circumstances where the appointment of a DPO is mandatory under the GDPR, see ibid., Art. 37(1).

16 Ibid., Art. 39.

17 Ibid., Art. 38.

18 Ibid., Art. 38(3). On the protection of the DPO against dismissal, see Case C-534/20 Leistritz AG v LH EU:C:2022:495.

19 GDPR, Art. 38(3). See also Article 29 Data Protection Working Party, “Guidelines on Data Protection Officers (‘DPOs’)” (2016) <https://ec.europa.eu/newsroom/article29/items/612048> (last accessed 15 September 2026), paras. 3.3.3–3.3.5.

20 See Belgian Data Protection Authority, “Decision 18/2020” (2020) <https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-18-2020.pdf> (last accessed 15 September 2026). The decision emphasised that the DPO performs advisory and monitoring functions and is not responsible for the controller’s ultimate compliance decisions; responsibility for ensuring the DPO’s independent performance remains with the controller.

21 On conflicts of interest arising from the DPO holding other roles, see ibid. See also Case C-453/21 X-FAB Dresden GmbH & Co KG v FC EU:C:2023:79.

22 See Belgian Data Protection Authority, “Decision 110/2023” (2023) <https://autoriteprotectiondonnees.be/rapport-annuel/themes/dpo> (last accessed 20 July 2026).

23 See President of the Personal Data Protection Office (Poland), “Decision DKN.5112.14.2022” (2024) <https://uodo.gov.pl/en/553/1833> (last accessed 20 July 2026).

24 For further discussion, see Article 29 Data Protection Working Party, supra, note 19.

25 GDPR, Arts. 37(7), 38(4) and 39(1)(d)–(e).

26 See Charter of Fundamental Rights of the European Union [2012] OJ C326/391, Art. 8. See also O Lynskey, The Foundations of EU Data Protection Law (Oxford University Press 2015).

27 Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (Text with EEA relevance) [2015] OJ L141/73, Art. 8(4).

28 Commission Regulation (EU) No 965/2012 of 5 October 2012 laying down technical requirements and administrative procedures related to air operations pursuant to Regulation (EC) No 216/2008 of the European Parliament and of the Council [2012] OJ L296/1, ORO.GEN.210.

29 Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA [2016] OJ L119/89, Art. 32.

30 For further socio-legal analysis, see K. A. Bamberger and D. K. Mulligan, Privacy on the Ground: Driving Corporate Behavior in the United States and Europe (MIT Press 2015).

31 Ibid.

32 For more discussion in this connection, see European Data Protection Board, “Coordinated Enforcement Action, Designation and Position of Data Protection Officers” (2024) <https://www.edpb.europa.eu/documents/coordinated-enforcement-framework/coordinated-enforcement-action-designation-and-position_fr> (last accessed 17 July 2026). For national practice, see, for example, Belgian Data Protection Authority, supra, note 20. See also Belgian Data Protection Authority, supra, note 22. See also President of the Personal Data Protection Office (Poland), supra, note 23.

33 See in this connection, Veale and Borgesius, supra, note 9.

34 See EU Artificial Intelligence Act, Art. 3(8) (defining “operator”); Art. 9(2) (requiring a continuous, iterative risk-management process throughout the lifecycle of high-risk AI systems); Art. 16 (setting out providers’ obligations); Arts. 22–5 (governing authorised representatives, importers, distributors and the allocation of responsibilities along the AI value chain); and Art. 26 (setting out deployers’ obligations).

35 More specifically, the AI Act prohibits specified AI practices, subjects high-risk systems to extensive requirements, imposes targeted transparency obligations on certain systems, and encourages voluntary codes of conduct for other AI systems. See ibid., Arts. 5 (prohibited AI practices), 6(1)–(3) and Annexes I and III (high-risk AI systems), 50 (transparency obligations for specified AI systems), and 95(1) (voluntary codes of conduct for AI systems other than high-risk AI systems).

36 Ibid., Art. 6, Arts. 8–16, and Annexes I and III.

37 For more on the detailed requirements of high-risk AI systems under the AI Act, see ibid., Arts. 9–11 and 72, and Annex IV.

38 Ibid., Art. 16.

39 Ibid., Art. 26.

40 Ebers, supra, note 9.

41 EU Artificial Intelligence Act, Art. 7(1)–(3).

42 For discussion along these lines, see Ebers, supra, note 9.

43 Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Text with EEA relevance) [2026] OJ L 24.7.2026, Art. 1(40).

44 EU Artificial Intelligence Act, Art. 17.

45 Ibid., Art. 17.

46 Ibid., Art. 17(1)(m). On the further specification of this framework through standardisation, see EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes, published by CEN-CENELEC in July 2026. The standard specifies requirements and provides guidance for defining, implementing, maintaining and improving quality management systems for organisations that provide AI systems.

47 GDPR, Arts. 37–9.

48 For a more detailed report on the DPO’s role in practice, see European Data Protection Board, supra, note 32. Based on coordinated investigations by 25 EEA data protection authorities and more than 17,000 responses from organisations and DPOs, the Report found that most responding DPOs reported being consulted and adequately informed to perform their tasks, while persistent shortcomings remained regarding designation, resources, expertise, independence and direct reporting to senior management. It therefore recommended measures to strengthen DPOs’ independence and capacity.

49 On the organisational barriers to implementing responsible AI, see B. Rakova and others, “Where Responsible AI Meets Reality: Practitioner Perspectives on Enablers for Shifting Organizational Practices” (2021) 5 Proceedings of the ACM on Human–Computer Interaction 7:1 <https://doi.org/10.1145/3449081>. See also B. Green, “The Contestation of Tech Ethics: A Sociotechnical Approach to Technology Ethics in Practice” (2021) 2 Journal of Social Computing 209 <https://doi.org/10.23919/JSC.2021.0018>. See also V. Dignum, “Can AI Systems Be Ethical?” in V. Dignum (ed), Responsible Artificial Intelligence: How to Develop and Use AI in a Responsible Way (Springer International Publishing 2019) <https://doi.org/10.1007/978-3-030-30371-6_5>.

50 See GDPR, Art. 39.

51 EU Artificial Intelligence Act, Art. 17(1)(j).

52 See ibid., Art. 87. For detailed requirements of the whistleblower protection regime, see Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law [2019] OJ L305/17, Arts. 19 and 21.

53 EU Artificial Intelligence Act, Arts. 17(1) and (3).

54 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (Text with EEA relevance) [2017] OJ L117/1, Arts. 15(1) and (5).

55 EU Artificial Intelligence Act, Arts. 17(4) and 26(5).

56 Ibid., Art. 22(4).

57 For further discussion on human oversight under the AI Act, see, for example, J. Laux and H. Ruschemeier, “Automation Bias in the AI Act: On the Legal Implications of Attempting to De-Bias Human Oversight of AI” (2025) 16 European Journal of Risk Regulation 1519 <https://doi.org/10.1017/err.2025.10033>. See also A. M. Corrêa, S. Garsia and A. Elbi, “Better Together? Human Oversight as Means to Achieve Fairness in the European AI Act Governance” (2025) 1 Cambridge Forum on AI: Law and Governance e29 <https://doi.org/10.1017/cfl.2025.10010>. See also M. Fink, “Human Oversight under Article 14 of the EU AI Act” (Social Science Research Network, 14 February 2025) <https://doi.org/10.2139/ssrn.5147196> (last accessed 22 July 2026).

58 EU Artificial Intelligence Act, Art. 14.

59 See Fink, supra, note 57, highlighting that effective human oversight depends on implementation that accounts for cognitive limitations and automation bias and avoids treating human oversight as a standalone safeguard. See also Laux and Ruschemeier, supra, note 57, examining automation bias and the limitations of requiring overseers merely to remain aware of it. See also Corrêa, Garsia and Elbi, supra, note 57, arguing that human oversight may promote fairness by mitigating bias and error, supporting accountability, and introducing empathy and contextual sensitivity, while finding that the AI Act only partially operationalises these functions.

60 For more on the detailed requirements of human oversight under the AI Act, see EU Artificial Intelligence Act, Art. 14(2)–(4) and Recital 73.

61 Ibid., Art. 26(2).

62 Ibid., Arts. 14(1)–(4) and 26(2). See also GDPR, Arts. 22(3) and 25.

63 T. Yokoi and M. R. Wade, “How Organizations Navigate AI Ethics” (5 October 2023) <https://www.imd.org/ibyimd/governance/how-organizations-navigate-ai-ethics/> (last accessed 15 September 2026).

64 For more on AI ethics, see A. Jobin, M. Ienca and E. Vayena, “The Global Landscape of AI Ethics Guidelines” (2019) 1 Nature Machine Intelligence 389 <https://doi.org/10.1038/s42256-019-0088-2>. See also M. Rauhala and others, “Ethical and Legal Aspects of an AAL System Supporting Night Care in Residential Care” in R. Wichert and H. Klausing (eds), Ambient Assisted Living (Springer International Publishing 2016) <https://doi.org/10.1007/978-3-319-26345-8_9>.

65 For more discussion on AI ethics, see Jobin, Ienca and Vayena, supra, note 64. See also World Health Organization, Ethics and Governance of Artificial Intelligence for Health: WHO Guidance (World Health Organization 2021) <https://www.who.int/publications/i/item/9789240029200> (last accessed 15 September 2026).

66 See in this connection M. Wade and others, “Do You Really Need a Chief AI Officer?” (2024) 66 MIT Sloan Management Review 62. See also M. Schäfer and others, “AI Governance: Are Chief AI Officers and AI Risk Officers Needed?” ECIS 2022 Research Papers (2022) <https://aisel.aisnet.org/ecis2022_rp/163> (last accessed 15 September 2026).

67 Office of Management and Budget, “OMB M-25-21 Accelerating Federal Use of AI through Innovation, Governance, and Public Trust” <https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf> (last accessed 15 September 2026). For further discussion, see also Wade and others, supra, note 66.

68 Schäfer and others, supra, note 66.

69 See, for example, IBM’s AI governance approach in IBM, “A Look into IBM’s AI Ethics Governance Framework” (4 December 2023) <https://www.ibm.com/think/insights/a-look-into-ibms-ai-ethics-governance-framework> (last accessed 15 September 2026).

70 Ibid.

71 For more details, see SAP, “Responsible AI” (SAP) <https://www.sap.com/products/artificial-intelligence/ai-ethics.html> (last accessed 15 September 2026).

72 See in this connection OneTrust’s approach, OneTrust, “Establishing an AI Governance Committee: An inside Look at OneTrust’s Process” (10 October 2025) <https://www.onetrust.com/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/> (last accessed 15 September 2026).

73 Ibid.

74 Google, “Our 2026 Responsible AI Progress Report” (17 February 2026) <https://blog.google/innovation-and-ai/products/responsible-ai-2026-report-ongoing-work/> (last accessed 15 September 2026).

75 Google, “Google AI Principles” (February 2026) <https://ai.google/principles/> (last accessed 15 September 2026).

76 Google, supra, note 74.

77 Ibid.

78 See in this connection Council of Europe, “Ad Hoc Committee on Artificial Intelligence (CAHAI) – Feasibility Study on a Legal Framework on AI Design, Development and Application Based on CoE Standards” <https://rm.coe.int/cahai-2020-23-final-eng-feasibility-study-/1680a0c6da> (last accessed 15 September 2026).

79 EU Artificial Intelligence Act, Art. 17(2).

80 See Digital Omnibus on AI, Art. 1, points (10) and (26), amending Arts. 11(1) and 63(1) of the AI Act.

81 European Commission, Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) [2021] COM/2021/206 final 3.

82 European Commission, Commission Staff Working Document Impact Assessment Accompanying the Proposal for a Regulation of the European Parliament and of the Council Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act) and Amending Certain Union Legislative Acts [2021] SWD(2021) 84 final, Section 8 (Preferred Option).

83 Ibid., Part 1, Section 2 (Problem Definition).

84 Ibid., Section 8 (Preferred Option).

85 See in this connection J. Black, “Forms and Paradoxes of Principles-Based Regulation” (2008) 3 Capital Markets Law Journal 425 <https://doi.org/10.1093/cmlj/kmn026>. See also C. Coglianese and D Lazer, “Management-Based Regulation: Prescribing Private Management to Achieve Public Goals” (2003) 37 Law & Society Review 691 <https://doi.org/10.1046/j.0023-9216.2003.03703001.x>.

86 For further discussion in this connection, see, for example, Veale and Borgesius, supra, note 9.

87 EU Artificial Intelligence Act, Art. 26(9); GDPR, Art. 35.

88 EU Artificial Intelligence Act, Art. 27(4).

89 Wade and others, supra, note 66.

90 See, for example, OneTrust, supra, note 72.

91 See, for example, Google, supra, note 74.

92 For detailed requirements, see Measure 8.1 of the Safety and Security Chapter in “The General-Purpose AI Code of Practice” <https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai> (last accessed 14 September 2026).