The European Data Protection Supervisor (EDPS) today published its Annual Report 2025, detailing a year of unprecedented activity and the operational launch of its expanded mandate under the EU's Digital Rulebook.

In a year marked by the rapid evolution of artificial intelligence, the EDPS established a dedicated AI Unit and launched a landmark AI regulatory sandbox pilot project, allowing EU institutions to test AI systems under regulatory guidance. The report also highlights the largest number of legislative consultations in a single year to date, through which the EDPS provided expert advice on critical issues ranging from digital identity to GDPR modifications.

Wojciech Wiewiórowski, European Data Protection Supervisor, said: "In 2024, we took stock of our history, marking 20 years of the EDPS. But 2025 was about moving forward, turning strategic into active governance, particularly in the realm of artificial intelligence. While we cannot eliminate every digital risk, the EDPS continues to evolve to remain fully equipped to guide the EU administration through this transformation with expertise, independence and an unwavering focus on the rights of the citizen."

In an example of this continuing evolution, 2025 saw the full activation of the EDPS AI Unit. Key achievements include the comprehensive mapping of the AI ecosystem across EU institutions, bodies, offices and agencies (EUIs) and the launch of a landmark AI regulatory sandbox pilot project. The AI Act Correspondents Network also deepened cooperation on AI challenges between EUIs. 2025 was also a foundational year for the EDPS's upcoming role as market surveillance authority and notified body for EUIs under the AI Act. In preparation for its expanded scope, the authority continued to build operational readiness to supervise AI in sensitive sectors such as law enforcement and migration.

It was also a record year for policy advice, as the EDPS responded to 145 legislative consultations, ranging over diverse topics from digital identity to targeted GDPR modifications. The EDPS maintained its focus on ensuring that any new legislative proposals remain legally sound and aligned with core EU values.

The EDPS continued to fulfil its supervisory role, doubling down on ensuring accountability within EUIs on all issues relating to data protection through investigations and audits, including the landmark investigation into the European Commission's use of Microsoft 365, and the auditing of various critical large-scale IT systems used in the Area of Freedom, Security and Justice by agencies such as Europol, Frontex and Eurojust.

Expanding its footprint in cybersecurity, the EDPS also became a permanent member of the new Inter-Institutional Cybersecurity Board, where it will play a central role in fortifying the digital infrastructure of the EU administration against evolving threats.

The EDPS remained at the forefront of technological foresight in 2025, analysing emerging trends in Agentic AI, AI companions and federated learning to anticipate the privacy challenges of tomorrow.

The 2025 report demonstrates that the EDPS is taking an active role in shaping the data protection environment in the evolving digital age, ensuring that innovation never comes at the expense of individual fundamental rights.

The full Annual Report 2025 is available on the EDPS website.

The rules for data protection in the EU institutions, as well as the duties of the European Data Protection Supervisor (EDPS), are set out in Regulation (EU) 2018/1725.

About the EDPS: The EDPS is the independent supervisory authority with responsibility for monitoring the processing of personal data by the EU institutions and bodies, advising on policies and legislation that affect privacy and cooperating with similar authorities to ensure consistent data protection. Our mission is also to raise awareness on risks and protect people's rights and freedoms when their personal data is processed.

Wojciech Wiewiórowski (EDPS) was appointed by a joint decision of the European Parliament and the Council to serve a five-year term, beginning on 6 December 2019.

The selection procedure for a new EDPS mandate for the next term of five years is still ongoing.